1Report a vulnerability
If you believe you have found a security vulnerability in FixTrail or in this website, write to security@quickpentest.com. Please report it to us privately first, and give us a reasonable time to fix it before you share it with anyone else. We read reports in English and Turkish.
The same contact details are published in machine-readable form, as the RFC 9116 standard describes, at /.well-known/security.txt.
2What to include
A useful report gives us:
- the product, page or component affected, and the version or address where you saw the issue;
- step-by-step instructions to reproduce it, with any proof-of-concept code, requests or screenshots;
- what an attacker could do with it — the impact as you understand it;
- your name or handle if you would like to be credited, and how we can reach you.
A short report we can reproduce is worth more than a long scanner export. If you came across personal data, do not include it in your report; describe what you saw instead.
3What happens next
We aim to acknowledge your report within three business days, and to send you an initial assessment — whether we can reproduce the issue and how severe we consider it — within ten business days. While we work on a fix we keep you informed, and we tell you when it is resolved.
We coordinate public disclosure with you. We ask you to wait until a fix is available, or until 90 days have passed since your report, whichever comes first, unless we agree a different date together. If we need longer, we will tell you why.
4Scope
Vulnerabilities in the FixTrail software itself are in scope wherever you find them, but you may only test systems you are authorised to test. The systems you may test under this policy are:
- this website, quickpentest.com;
- the FixTrail console, its API, the scan engine and the containers it starts, where we operate them.
The following are out of scope:
- deployments that our customers run in their own infrastructure. Do not test them without the owner's written permission; if you find a flaw in the software there, report it to us;
- denial-of-service or load testing, and anything else that degrades the service for others;
- social engineering, phishing or physical attacks against our staff, our premises or our customers;
- third-party services we use or integrate with — please report those to their owners;
- results from automated tools without a demonstrated, exploitable impact, such as missing headers, version banners or best-practice suggestions with no attack scenario.
5Rules for testing
- Test only against accounts and data that you own or have explicit permission to use.
- Access, change or delete no more data than you need to demonstrate the issue. If you reach personal or customer data, stop, do not keep or share it, and tell us.
- Do not degrade the service, scan at volume or try to keep access to a system.
- Do not exploit a vulnerability beyond what proves it, and do not move on to other systems.
- Keep the details confidential until we have agreed on disclosure.
- Do not ask for payment or any other benefit in exchange for withholding or disclosing a report.
6Safe harbour
If you make a good-faith effort to follow this policy, we consider your research authorised. We will not initiate or support legal action against you for it, and if a third party takes action against you over research that followed this policy, we will make it known that your work was authorised.
If you are not sure whether something is allowed, ask us first at security@quickpentest.com. This commitment covers our own systems and software; we cannot authorise testing of systems that belong to others, including our customers.
7Recognition
With your permission, we credit the researchers who report valid vulnerabilities in our release notes or security advisories. We do not currently run a paid bug bounty programme.
8How FixTrail protects your data
FixTrail holds the most sensitive list an organisation keeps — where it is vulnerable — so it is built to keep that list under your control and in the right hands.
- Your data stays under your control. The platform is deployed in your own environment, for one organisation; it is not a shared, multi-tenant service. Data leaves your environment only for the destinations you configure yourself: your ticketing, notification, SIEM and GRC tools, and a model provider if you turn on the optional AI features with a key of your own.
- Sessions cannot be read by page scripts. They live in HttpOnly cookies: a 15-minute access token and a refresh token that changes on every use, where replaying an old one ends the whole session. Every change carries a double-submit CSRF token.
- Access is role-based and checked on every request. Five roles map to fine-grained permissions, and the API checks the permission on each request; hiding a button in the interface is never the control. Accounts exist only by invitation or through your single sign-on (OIDC or SAML).
- Credentials are encrypted. The credentials connectors and integrations use are encrypted at rest, and never written into addresses, logs or error messages.
- Webhooks are signed. Scanner containers report back only through webhooks signed with HMAC-SHA256, and a missing secret refuses every request rather than accepting it. Scans run on a network that cannot reach the database.
- Decisions leave a trail. Administrative and remediation decisions are written to an append-only audit log.
- AI is advisory. It suggests and ranks, but it never closes a finding: closure needs a targeted rescan and a person's approval. Secrets found in an imported report are masked before anything is stored, summaries send a model only counts and titles, and every model call runs within a budget.
- Nothing changes your systems without approval. Actions towards your own systems are read-only, or drafts that wait for a person; a proposed code fix is never merged automatically.
9Contact
Security reports: security@quickpentest.com. Personal data: privacy@quickpentest.com. Everything else: sales@quickpentest.com.