At Pixie, we are committed to ensuring the security of our platform and protecting our users' data. We appreciate the efforts of security researchers and experts who help us maintain the integrity of our system by identifying vulnerabilities. This program is designed to provide a clear, transparent process for reporting security concerns, ensuring responsible disclosure, and allowing us to address issues effectively.

1. How to Report a Security Vulnerability

Identify the Issue: If you believe you have discovered a security vulnerability in Pixie, ensure it adheres to the guidelines of responsible disclosure.
Submit Your Report: Send an email to talk@hellopixie.ai with the following information.
Acknowledgment of Report: Upon submission, you will receive an acknowledgment from the team, confirming receipt of your report.
Remediation: Once the vulnerability is verified and addressed, we will provide a timeline of the fix and any relevant updates or patches. We aim to resolve all critical vulnerabilities as soon as possible.
Public Disclosure (Optional): After remediation, if you wish to be publicly recognized for your findings, we would be happy to include your name in our hall of fame.

2. Guidelines for Responsible Disclosure

We ask that you follow these guidelines to ensure responsible and safe vulnerability disclosure:

Respect the privacy of our users and do not access or compromise any personal data.
Follow all applicable laws and regulations while conducting your research.
Do not exploit any vulnerabilities for malicious purposes.
Do not interfere with or disrupt any services, systems, or data.
Do not disclose the vulnerability to the public or third parties before Pixie has had the opportunity to investigate and resolve it.
Use only the channels provided to report vulnerabilities. Social media or public forums should not be used for disclosure.

3. Recognition and Rewards

We deeply value the contributions of the security research community. While we do not currently offer financial rewards, we are committed to acknowledging your efforts. Successful reports may earn public recognition on our website’s hall of fame and, in some cases, gifts or exclusive Pixie merchandise.

4. Legal Safe Harbor

We pledge that if you act in good faith while investigating and reporting vulnerabilities, we will not pursue legal action against you. We ask that all researchers strictly adhere to our guidelines and avoid any form of malicious activity.

5. Feedback

For feedback, questions or suggestions on this policy, please contact our team at talk@hellopixie.ai. Your input is valuable for ensuring the policy remains clear, comprehensive, and relevant.

Security Disclosure Program