This English version is provided for convenience. The Spanish version is the one that applies.
Xeneural appreciates the work of those who research the security of XEN and xeneural.com in good faith. This policy explains what is in scope, how to report, what response you can expect and Xeneural's commitment not to take action against anyone who researches in accordance with it.
1. Scope
In scope:
- xeneural.com and its public subdomains.
- The XEN application (web and mobile applications).
- The XENI assistant, as regards permission bypass, data leakage between organisations or instruction injection that produces unauthorised actions.
Out of scope:
- Third-party systems we use (cloud, identity, email and artificial intelligence model providers): report them to their own programme.
- Denial-of-service attacks, mass mailing, social engineering of our staff or our customers, and physical access.
- Findings with no demonstrable security impact: best practices without an exploitation vector, informational headers, software versions with no known vulnerability, unconfirmed results of automated scanners.
2. Research rules
- Use only your own or test accounts; do not access, modify or download other customers' data. If you access someone else's data by accident, stop, do not keep it and report it immediately.
- Do not degrade the Service: no load testing, mass brute force or aggressive automation.
- Do not make the vulnerability public before it is fixed and we have agreed on publication.
- Comply with the applicable law.
3. How to report
Write to security@xeneural.com with: a description of the finding, steps to reproduce it, estimated impact, and your name or alias if you want recognition. You may attach screenshots or logs. If you need to encrypt the message, say so and we will send you a public key. Contact details are also at https://xeneural.com/.well-known/security.txt.
4. What you can expect from Xeneural
| Commitment | Timeline |
|---|---|
| Acknowledgement of receipt | 2 business days |
| Initial assessment and severity classification | 5 business days |
| Fix for critical or high vulnerabilities | 30 days from confirmation, or a communicated mitigation plan |
| Fix for medium or low vulnerabilities | 90 days from confirmation |
| Progress updates | At least every 15 days while the report is open |
| Coordinated publication | Agreed with the researcher after the fix |
We publicly acknowledge, with your permission, those who report valid vulnerabilities. We do not currently run a bounty programme; if we do in the future, it will be announced on this page.
5. Safe harbour
Xeneural considers research carried out in accordance with this policy to be authorised, good-faith conduct that does not constitute unlawful access. Xeneural will not initiate or support legal action against anyone who follows these rules, and if a third party did, we will state that the research was authorised. If a specific action leaves you unsure whether it is covered, ask us before carrying it out.
6. Changes
This policy is published with version and date. Changes do not affect reports already submitted.
Effective since September 28, 2026. Earlier versions are kept and provided on request at legal@xeneural.com.