Security reporting
Report the smallest useful evidence.
Admix accepts good-faith reports about potential security problems involving the systems explicitly listed below. Ordinary product-support problems belong in Support.
Reporting does not authorize testing
Automated scanning, vulnerability crawlers, fuzzing, credential attacks, brute-force tools, denial-of-service testing, and automated exploit attempts are not authorized without prior written permission from Admix.
Currently in scope
- The public website at
https://admixsoftware.comafter it is publicly available. - A released Admix product only when that exact product and version is specifically listed here in the future.
A product appearing in the catalog does not place private builds, development environments, customer systems, community servers, third-party platforms, or unreleased features in scope.
Not authorized
- Testing systems, accounts, or servers that you do not own or have explicit permission to test.
- Social engineering, phishing, physical testing, persistence, destructive testing, or service disruption.
- Accessing, modifying, retaining, or sharing another person's data.
- Testing that affects another user or bypassing authorization to obtain stronger evidence.
Stop after confirming the minimum necessary evidence. A problem in a third-party service should be reported to that provider. A problem in Admix code may be reported to Admix without testing or attacking the third party.
What to send
Email security@admixsoftware.com with:
- the affected public URL, product, and version;
- a concise description of the observed behavior and expected boundary;
- the minimum safe reproduction steps;
- the date and time observed; and
- sanitized evidence that does not contain credentials, secrets, unnecessary personal information, or another person's data.
Do not send live credentials, access tokens, customer information, full private logs, or exploit payloads that are unnecessary to understand the report.
Program boundaries
Admix does not currently offer a bug bounty, payment, confidentiality promise, legal safe harbor, or guaranteed response deadline. Written permission for a specific test, if ever granted, controls only the target, method, time window, rate, and other limits stated in that permission.