PAX Technology Limited (hereinafter referred to as “PAX”, we, us or our) is committed to improving the security of our products and services to fully support the secure operations of our customers' networks and services. We encourage security researchers, industry organizations, customers, and suppliers to report to us the suspected vulnerabilities associated with publicly accessible assets of PAX. PAX has established a process for handling reported suspected vulnerabilities.

 

Security researchers shall place our users’ interests at the forefront and respect the privacy of users. PAX encourages the interest parties to discover and report vulnerabilities legally and commits to working with security researchers to understand, confirm, and appropriately resolve the vulnerability. Vulnerability information shall not be disclosed by you to anyone outside PAX before being submitted to PAX. Without PAX’s written consent, any disclosure to the public would violate the terms and conditions of this Program.

 

PAX urges the reporting party to follow the Responsible Disclosure Policy, which involves privately notifying us of any security vulnerabilities before fully disclosing them to allow us to resolve the vulnerabilities and minimize any overall risk to users. During the entire process, PAX will strictly control the scope of information distribution. PAX will request the reporting party to keep the vulnerability confidential until PAX has completed the fix.