Security

Reporting a vulnerability

Email sachin.rana@ideaxa.io with SECURITY in the subject line. Include the affected host or URL, the steps to reproduce, and what you were able to achieve. A proof of concept helps. Please do not open a public issue or post the details before we have responded.

What we commit to

• Acknowledgement within one business day, from a named person rather than a ticket robot.
• An assessment within five business days, including our severity rating and whether we agree with yours.
• A fix timeline in writing, and an update when it ships.
• Credit where you want it. We will name you in the fix note, or keep you anonymous, whichever you prefer.

We do not run a paid bounty programme. We will not take legal action against good-faith research that follows the scope below.

Scope

In scope:

• This website and anything under the https://ideaxa.io domain.
• The public MQTT broker, OPC-UA reference server, and WebSocket bridge described on the status page.

Out of scope, and please do not attempt:

• Denial of service, volumetric testing, or anything that degrades the public broker for other developers.
• Social engineering of our staff, our clients, or our suppliers.
• Client systems we operate under contract. Those have their own disclosure channels — ask us and we will route you.
• Findings that are purely informational, such as a missing header on a page with no session, absent a demonstrated impact.

This website’s attack surface

The site is a static export served by nginx. There is no application server, no database, no session, and no authentication. It sets no cookies and runs no third-party scripts. The only outbound request the browser makes to another origin is the form submission to Formspree, and only when you submit one.

Our own posture

• SOC 2 Type II readiness, GDPR-compliant data handling, and an ISO 27001-aligned ISMS for internal operations.
• An annual third-party penetration test of our own infrastructure.
• Short-lived cloud credentials, OIDC from CI, and no long-lived static keys.
• Every engineer signs an NDA, an IP-assignment agreement, and the firm’s security policy before touching a client repository.
• Client data is never used for training, never shared with third parties, and never leaves the contracted region.

Asking us for evidence

If you are a client or a prospective client and your security review needs our policies, pentest summary, or a completed questionnaire, email sachin.rana@ideaxa.io. We turn these around rather than making you chase them.