If you discover a security vulnerability in any StaxDash project, please do not open a public GitHub issue. Report it privately by emailing contact@staxdash.com with as much detail as you can provide.

Please include:

• The affected project and version
• A description of the vulnerability and its impact
• Steps to reproduce, or a proof-of-concept
• Any suggested mitigation, if you have one

Security fixes are applied to the latest release of each project. Older releases are not retroactively patched unless the fix is trivial or a contract/SLA requires it.

• We acknowledge receipt of a report within 2 business days.
• We aim to provide a first assessment within 5 business days.
• We coordinate disclosure: you'll be credited if you wish, and we'll publish a fix and advisory once ready.

We will never require a bug bounty for responsible disclosure (no program is currently offered, but good-faith reports are always welcome).

• StaxSys / StaxPing2 — read system metrics via native APIs and standard library; no network listeners or telemetry.
• StaxMonitor — the on-prem agent ships signed binaries and supports air-gapped deployment. Do not run unsigned builds in production.
• StaxLens — a hosted service; access is authenticated and scoped per tenant. Reports related to auth, multi-tenancy, or data isolation should be prioritized.
• StaxSuite / StaxOffice — local-first desktop apps; treat files opened from untrusted sources as untrusted input.