Main siteReport a vulnerability

Security & Trust

Responsible software engineering and security governance at CYBX.

CYBX is a founder-led software engineering company building SaaS products, APIs, automation, and technology infrastructure. This page explains who is responsible for security, which systems that responsibility covers, and how to report a vulnerability.

Report a vulnerabilityRead the disclosure guidelines
Security Lead
Victor Barbieri Corrêa
Security contact
security@cybx.dev
Scope
Systems owned or controlled by CYBX
Last reviewed

Security Leadership

Victor Barbieri Corrêa

Founder & Security Lead

Victor is the designated point of contact for coordinating CYBX's internal product-security responsibilities, security inquiries, and vulnerability reports.

CYBX is a founder-led company, and its security function is carried out by one person. Report triage, security decisions, and remediation coordination are handled directly by the Security Lead rather than by a separate security team.

Security Scope

CYBX's security responsibilities concern the systems it builds, operates, or otherwise controls:

Software products
Applications designed, built, and maintained by CYBX.
SaaS platforms
Hosted services that CYBX operates for its users.
APIs
Interfaces that CYBX publishes or operates.
Development infrastructure
Source repositories, build and deployment pipelines, and hosting environments used to deliver CYBX software.
Other controlled systems
Any other system that is owned or controlled by CYBX.

Security Approach

Security at CYBX is organized into five areas of responsibility, each owned by the Security Lead. They describe what CYBX takes responsibility for. They are not independently audited or certified controls.

  • Secure software development

    Bringing security considerations into how CYBX software is designed, written, reviewed, and released, so that weaknesses are addressed during engineering rather than after deployment.

  • Vulnerability intake and assessment

    Receiving security reports through a single channel, validating them, and assessing their severity and their impact on CYBX systems and the people who use them.

  • Authentication and access-control review

    Reviewing how CYBX products verify identity, manage sessions, and enforce permissions, including the separation of data between users and organizations.

  • Dependency and infrastructure security

    Tracking the third-party libraries and services CYBX software depends on, and keeping the hosting, build, and deployment environments CYBX controls configured and up to date.

  • Security documentation and remediation coordination

    Recording security findings and decisions, coordinating fixes with the affected product, and keeping reporters and, where appropriate, affected users informed.

Responsible Vulnerability Disclosure

If you believe you have found a security vulnerability in a system owned or controlled by CYBX, please report it to security@cybx.dev. Reports are received and reviewed by the Security Lead.

What to include

Affected assets
The product, URL, API endpoint, or component involved.
Reproduction steps
The steps, requests, or proof-of-concept details needed to reproduce the issue.
Potential impact
What an attacker could achieve, and under which conditions.
Contact information
How CYBX can reach you with follow-up questions.

Rules of engagement

  • Testing requires prior authorization. Do not actively test CYBX systems without written authorization from the Security Lead. If you notice a vulnerability during normal use, report it without further probing.
  • Destructive or disruptive activity is not authorized. This includes denial of service, deleting or modifying data, degrading availability, spam, social engineering, and physical attacks.
  • Keep data exposure to a minimum. Access only what is needed to demonstrate the issue. Do not retain or share data you encounter, and leave unnecessary personal data out of your report.
  • Coordinate before publishing. Allow CYBX reasonable time to investigate and remediate before sharing details publicly.

CYBX does not operate a bug bounty program and does not offer rewards for vulnerability reports.

Email a security report

Authorized Security Research

CYBX supports security assessments that are scoped in advance and explicitly authorized, limited to systems CYBX owns or controls.

How authorization works

  1. Request

    Email security@cybx.dev with the systems you propose to assess, your methods, the intended time window, and who you are.

  2. Written scope

    Authorization is valid only once the Security Lead confirms it in writing, naming the approved systems, techniques, and dates.

  3. Assessment

    Testing stays inside the approved scope. Anything outside it, including third-party systems, remains unauthorized.

  4. Reporting

    Findings go to security@cybx.dev, and remediation is coordinated with the Security Lead.

Current status

In place

  • A designated Security Lead and a dedicated security contact
  • Published vulnerability disclosure guidelines, on this page
  • A written-authorization requirement for any security testing

Planned

  • Independent, scoped security assessments of CYBX-controlled systems, conducted under written authorization

No completed penetration test or independent assessment is claimed on this page. If one is completed, this page will say so explicitly.

Request authorization

Transparency

This page provides information about CYBX's security responsibilities and how to engage with them. It is not proof of external certification or independent audit.

  • This page makes no claim of ISO/IEC 27001 certification, a SOC 2 report, or any other certification or compliance attestation.
  • No independent penetration test or security audit report is referenced here.
  • The areas of responsibility described above are self-described and have not been independently verified.

Last reviewed . Questions about this page can be sent to security@cybx.dev.

Contact

Victor Barbieri Corrêa

Founder & Security Lead