Security and vulnerability disclosure

In scope

• The editor, dashboard and API at app.xeek.be, and this website (xeek.be).
• The platform that serves sites on xeek.site and customers’ own domains: hosting, previews, the canvas and uploaded assets.
• The MCP server (mcp.xeek.be), the public API (api.xeek.be), our command-line tool and our email sending.
• Ways one customer’s data or site could reach another’s.

Out of scope

• The content of sites our customers publish: report abuse at abuse@xeek.be.
• Denial of service, load testing, spam and social engineering of our team or customers.
• Physical attacks, and services we don’t run (our payment and sign-in providers).
• Reports from automated scanners without a demonstrated impact, and missing best practices without one.

Safe harbour

If you act in good faith under this policy, we will not take legal action against you or report you for it. In good faith means: you only test against your own account or a test account, you stop as soon as you have shown the issue, you don’t access, change or keep other people’s data beyond what you need to show it, you don’t disrupt the service, and you give us reasonable time to fix the issue before you tell anyone else.

What to expect

• We confirm your report within 3 working days.
• We give you our first assessment within 10 working days.
• We aim to fix critical issues within 30 days, high within 60 and medium within 90.
• We agree a disclosure date with you; by default 90 days after your report.
• We credit you if you wish. We don’t offer paid rewards yet.