Vulnerability Disclosure Policy

We welcome reports from security researchers and customers who find vulnerabilities in GalaxyGate services. This policy describes what is in scope, how to report an issue and what you can expect from us.

Reporting

Email [email protected] in English. Please include:

• The affected host, URL or product.
• A description of the issue and its impact.
• Steps to reproduce, with any proof-of-concept code, requests or screenshots.

Our contact details are also published in security.txt.

Scope

• galaxygate.net and its subdomains, including billing.galaxygate.net, dash.galaxygate.net and api.galaxygate.net.
• Infrastructure operated by GalaxyGate.

Services and content that our customers run on GalaxyGate servers are out of scope. Report abuse coming from our network through a support ticket.

Rules

• Only test against accounts and services you own, or have permission to test.
• Access, modify or keep only the data needed to demonstrate the issue. If you reach customer data, stop and report it to us.
• Do not run denial of service attacks, high-volume automated scans, social engineering, phishing or physical attacks.
• Give us reasonable time to fix the issue before you disclose it publicly. We aim to resolve reports within 30 days.

Leaked credentials

If you find a GalaxyGate API token exposed in public, revoke it with a POST to https://api.galaxygate.net/v1/credentials/revoke. No authentication is needed. Send up to 100 tokens per request:

{
  "credentials": ["gga.0123456789abcdef0123456789abcdef"],
  "url": "https://github.com/example/repo/blob/main/.env",
  "source": "commit"
}

url (where the token was found) and source are optional. We revoke the tokens and notify the account owners. For leaked passwords or other credentials, email [email protected].

What to expect

• We confirm receipt of your report within 3 business days.
• We keep you updated while we investigate and fix the issue.
• We credit you for the finding if you want us to.

We will not pursue legal action against researchers who act in good faith and follow this policy.