Found something wrong with naxxan.ai or our public artifacts? Tell us privately:
engagements@naxxan.ai — include the URL/artifact, what you observed, and how to reach you. We acknowledge reports within 5 business days.
What we want to hear about: vulnerabilities in our site, tampering with published evidence (sha256 mismatches), and anything that breaks the verifiability we claim. A security.txt file authorizes no testing beyond what our published scopes declare — pentesting our clients' targets is a paid, signed engagement, not a bug bounty.
We credit researchers in our public corrections record when fixes land, at your preference.