How to report
Email contact@masorix.com with the subject “Security report.” Machine-readable contact details are published at /.well-known/security.txt.
Please include enough detail for us to reproduce the issue safely: the affected product and version or URL, the device and operating system, the steps you took, what you observed, and why you believe it is a security problem. Proof-of-concept code, logs, or recordings help, provided they do not contain other people’s data.
Scope
This policy covers this website and Masorix products. Each product may publish its own security page with product-specific detail; if it does, that page applies to the product and this one applies to the company.
Reports about services we rely on rather than our own code — app stores, operating systems, hosting, and other vendor platforms — should go to that vendor. We are glad to help you identify the right contact.
Out of scope
- Denial-of-service, volumetric, or resource-exhaustion testing.
- Social engineering, phishing, or physical attacks against Masorix or its users.
- Automated scanner output with no demonstrated impact, and missing security headers or best-practice recommendations with no exploit path.
- Any testing that accesses, modifies, or destroys another person’s data.
What to expect
Masorix is a small company, and we would rather commit to targets we can meet than to impressive ones we cannot.
- We acknowledge your report within 5 business days.
- We tell you whether we consider it a valid security issue, and our initial severity assessment, within 15 business days.
- We update you at least every 30 days while we work on a fix.
- We tell you when a fix has shipped, and in which version.
Where the law requires us to notify an authority — for example a regulator under applicable data-protection law, or a computer security incident response team under applicable product-security law — we will do so within the required deadlines. That obligation is independent of this policy and does not change what we owe you as a reporter.
Coordinated disclosure
Please give us a reasonable opportunity to fix an issue before disclosing it publicly. We ask for 90 days from your first report, and we will work to be faster than that for anything serious.
If we cannot fix an issue within 90 days we will tell you why and agree a revised date with you rather than ask for open-ended silence. If an issue is already being exploited, we may act and disclose faster. With your permission we are glad to credit you by name or handle when we publish a fix.
Safe harbour
If you make a good-faith effort to follow this policy while researching a vulnerability, Masorix will not pursue or support legal action against you for that research, and we will treat your activity as authorized under applicable computer-misuse law.
This protection depends on you acting in good faith: test only against your own device, accounts, and data; stop as soon as you have confirmed a vulnerability; do not access, copy, modify, retain, or destroy anyone else’s data; do not degrade the service for others; and do not extort, threaten, or publish other people’s information.
We cannot grant safe harbour on behalf of anyone else. Third parties whose services or infrastructure you touch have their own policies, and this page does not bind them.
Rewards
Masorix does not operate a paid bug-bounty programme and does not currently offer monetary rewards. We say so plainly rather than leaving it ambiguous. We offer prompt handling, honest communication, public credit if you want it, and a direct line to the people who write the code.
Contact
contact@masorix.com
Masorix LLC, registration number 999.110.1593071
25 Marshal Baghramyan Street, Apt. 4, Aparan 0301, Aragatsotn Province, Republic of Armenia
+374 44 225600
We do not currently publish a PGP key. If you need to send something encrypted, email us first and we will arrange a channel. See also our Privacy Policy.
Last updated: August 19, 2026