Responsible disclosure

Found a vulnerability? Tell us.

Denpex takes reports seriously. We acknowledge valid submissions within one business day and aim to ship a fix within 30 days. We do not pursue legal action against good-faith security research that complies with this policy.

How to report

Email security@denpex.com with reproduction steps, impact, and any proof-of-concept code.
Or open a private security advisory on our GitHub: github.com/denpex/security.
Our machine-readable security contact and policy are published at /.well-known/security.txt.

What to expect

Acknowledgement within one business day.
Triage and reproduction (usually within 5 business days).
Fix shipped within 30 days for valid issues (or sooner for critical severity).
Public credit in our Hall of Fame (coming soon). Only with your permission.

Scope

In scope: denpex.com, api.denpex.com, console.denpex.com, the agent (/agent/denpex.py), and our public GitHub repositories.

See the Trust Center for our SOC 2 status and security posture.