HostAxe Security Policy
Version 2026.11.01 · Effective 1 November 2026

1. Protection and limits
HostAxe uses local encrypted storage backed by OS protection, installation-bound signed licensing evidence, SSH host-key checks, restricted native operations and authenticated release/update checks. These controls reduce risk without guaranteeing safety on a compromised OS or against commands you authorise. Protect the OS account, keep supported software updated and verify unfamiliar host fingerprints. Our development process incorporates NIST SP 800-218 SSDF v1.1 practices: threat review, dependency/source checks, negative regression tests, controlled release gates and vulnerability response. This is an implementation approach, not NIST certification or a claim that every organisational practice has been independently assessed.

2. Private vulnerability reporting
Email rox.techlead@gmail.com with subject HostAxe security report. Include affected version and OS, impact, reproduction steps and a minimal proof of concept. Exclude live credentials, activation keys, private keys, third-party personal data and customer transcripts. Ask for a secure transfer method before sending sensitive material. This is the currently published contact; an unconfigured security mailbox is not implied. Test only systems and accounts you own or are authorised to assess. Avoid disruption, social engineering, persistence and accessing other people’s data. We welcome good-faith reports and do not treat a report itself as abuse; this is not permission to attack third parties or a paid bounty promise.

3. Triage, fixes and disclosure
We aim to acknowledge within three business days and provide an initial assessment within ten business days. These are targets, not guaranteed resolution dates. We assess severity, reachability, affected versions and mitigations, prioritise exploitable high-impact issues and discuss progress and coordinated disclosure timing with the reporter. Fixes receive regression tests and release verification. Upstream issues without an immediate patch require a scoped mitigation, owner and review date; an exception is not described as a patched dependency. Public advisories explain affected/fixed versions, impact and mitigations, with credit where agreed and without operational secrets or unnecessary exploit detail. Reasonable disclosure timing can be discussed if progress stalls.

4. Supported releases and authenticity
Security fixes target the current supported stable release. Check https://roxensoft.com/en/hostaxe for releases and support notices. Do not assume indefinite fixes for an old build or that development output is an official signed release. Signed required-update notices do not themselves revoke a purchased licence. Obtain installers from official release links, check platform trust prompts and published integrity evidence where provided. The contact above also accepts questions about package authenticity, recovery and suspected licensing incidents. Never send private signing or SSH keys to support.