How should security issues be reported?
Email support@crabix.ai with a concise description, affected component, reproduction steps, impact, and any relevant logs or screenshots.
Machine-readable file: /.well-known/security.txt.
Canonical policy page: /security.
Please avoid public disclosure until the CrabiX team has had a reasonable opportunity to investigate and fix a valid issue.
What is in scope?
In scope: crabix.ai, releases.crabix.ai release delivery, public download metadata, and security issues in the CrabiX desktop app or local gateway that can be responsibly reproduced.
Out of scope without written permission: denial-of-service testing, social engineering, phishing, spam, physical attacks, and attempts to access data that is not yours.
The local-first security model is explained in the security and privacy guide.
Reports should avoid including real user secrets or third-party personal data.
FAQ
Where is CrabiX security.txt?
CrabiX publishes security.txt at /.well-known/security.txt and redirects /security.txt there.
Does this policy authorize security testing?
No. The policy provides contact and scope guidance; it does not grant permission for destructive testing, denial of service, exfiltration, or testing against third-party systems.
Model digest
CrabiX security contact metadata is published at https://crabix.ai/.well-known/security.txt with policy page https://crabix.ai/security. Security reports should go to support@crabix.ai and include affected component, reproduction steps, and impact. The policy covers crabix.ai, releases.crabix.ai release delivery, public download metadata, and responsibly reproducible CrabiX app issues. It does not authorize destructive testing or data exfiltration.