RESPONSIBLE DISCLOSURE

Vulnerability Disclosure Policy

Sextant (sextantquant.com) — version 1.1, in force since 28 September 2026 (version 1.0: 4 May 2026).

In short: if you discover a security vulnerability affecting Sextant, contact us at [email protected] (PGP optional on request). We acknowledge receipt within 72 h, investigate, and coordinate joint publication within 90 days maximum. No monetary reward at this stage, but systematic public recognition for valid reports.

1. Scope

In scope

https://www.sextantquant.com and https://sextantquant.com (frontend, public pages, authenticated dashboard)
https://api.sextantquant.com (API: audit request form, sign-up from the Mirror, payment)

Out of scope

Third-party services we use but do not control (Stripe, Cloudflare, OVH, Vercel, Google, Microsoft). Contact their security team.
Theoretical vulnerabilities without proof of exploitation (e.g. raw automated scanner output, missing headers without demonstrated impact)
Brute-force or application-layer denial-of-service (rate limiting already in place)
Self-XSS requiring active victim cooperation
Phishing and social engineering
Vulnerabilities on unsupported browsers / OS (IE 11, Android < 9, etc.)
Missing SPF/DKIM/DMARC on subdomains not used for email sending

2. Rules of engagement

Only access your own data. If a vulnerability allows access to other users' data, stop immediately and report — do not exfiltrate.
No modification or destruction. No DROP TABLE, no spam POSTs, no deletion of other accounts.
No DoS/DDoS, no high-throughput fuzzing that would degrade the service.
No publication before coordination. We commit to transparent dialogue; in return, do not publicly announce the vulnerability before a fix is deployed or 90 days have elapsed (whichever comes first).
Good faith presumed. We will not take legal action against a researcher who follows these rules in good faith. This commitment binds us only: it cannot set aside criminal law or the rights of a third party.

3. How to report

Send your report to [email protected]. Request our PGP key if you wish to encrypt the report.

Recommended format

Subject: [VULN] <OWASP category> — <6-word summary>

1. Category (XSS, IDOR, SSRF, RCE, auth bypass, etc.)
2. Affected URL / endpoint
3. Reproduction steps (numbered, copyable)
4. Impact (what can an attacker concretely do?)
5. Proof of concept (screenshot, video, payload — without exfiltrating)
6. Suggested fix (optional)
7. Your public handle if you wish to be credited

4. Our response commitment

Step	Target delay
Acknowledgement of receipt	72 hours (FR business days)
Initial triage + severity	5 business days
Fix plan communicated	2 weeks
Maximum embargo before publication	90 days (negotiable if fix is complex)
Coordinated publication + credit	after fix deployment

5. Recognition

Sextant offers no monetary reward. However, any valid report leads to:

Public thanks, if you wish
Mention in the changelog and disclosure post
Signed thank-you letter for your portfolio

6. Safe harbor

We commit to not pursuing legal action against security researchers who:

respect this policy in good faith,
limit themselves to non-destructive testing techniques,
only access data strictly necessary for demonstration,
give us reasonable time to fix before publication.

If you have any doubt about the scope of this protection, contact us before your test at [email protected].

7. security.txt file

This policy is announced via the RFC 9116 standard at /.well-known/security.txt.