Security & Responsible Disclosure
Last Updated: October 17, 2026
HOW WE PROTECT YOUR INFORMATION
HEXASPEAR uses reasonable technical and organisational safeguards designed to protect personal information — authentication, server-side authorisation, database security rules, access controls and logging.
We do not claim that HEXASPEAR is completely secure. No service can honestly make that claim, and one that does is telling you something about itself.
REPORTING A VULNERABILITY
If you believe you have found a security vulnerability, we would rather hear it from you than from an attacker.
Email hexaspear@gmail.com with the subject line "Security Report". Tell us what you found, where, and how to reproduce it.
We will acknowledge security reports within 24 hours. We do not currently run a paid bug bounty.
WHAT A GOOD-FAITH RESEARCHER MUST NOT DO
While testing, please do not:
- Access user information beyond what is strictly necessary to demonstrate the issue
- Modify or destroy any information
- Disrupt the service for other users
- Conduct denial-of-service attacks
- Exploit a vulnerability further than is needed to show that it exists
- Publish the issue before we have had a reasonable opportunity to fix it
Research carried out within these limits and reported in good faith is welcome, and we will not pursue action over it.
IF A BREACH HAPPENS
We will handle personal-data breaches and the notifications they require in accordance with applicable legal obligations, including those under India's Digital Personal Data Protection framework as it comes into force.
In practice that means: investigate on discovery, notify the authorities where required, inform affected users where the breach poses a significant risk to them, and fix the cause.