Security & Responsible Disclosure

1. Our commitment

Xplug.in builds plugins and integrations that run inside enterprise video management systems (VMS) such as Milestone XProtect and Genetec Security Center — software our clients rely on for physical security. We hold our own infrastructure to that same standard. This page describes the technical and organisational measures protecting xplug.in, and sets out how independent security researchers can responsibly report a vulnerability to us.

2. How xplug.in is protected

The public website at xplug.in is intentionally built as a small, dependency-free static site (no server-side application framework, no custom database, no CMS admin panel) to minimise its attack surface. Concretely:

• Transport security — the Site is served exclusively over HTTPS/TLS; there is no plaintext HTTP endpoint for visitor traffic.
• Edge protection — traffic is routed through Cloudflare, providing DDoS mitigation, bot/abuse filtering, and DNS security in front of the origin.
• Static hosting — the Site is deployed as static assets via Vercel, with no server-side code execution, no exposed admin login, and no database that visitor input is written into.
• No stored form database — the "Project brief" contact form is relayed directly to our inbox via Web3Forms; we do not operate a database of form submissions that could itself be a target for a data breach.
• Anti-spam controls — a hidden honeypot field on the contact form helps filter automated/bot submissions.
• Least-privilege access — access to the Site's source repository, hosting dashboard, and DNS/CDN configuration is restricted to authorised personnel only.
• Dependency hygiene — because the Site has no build step or third-party JavaScript framework, it carries no transitive npm/package supply-chain risk from front-end dependencies.

3. How form data is handled

Information submitted through the contact form (name, work email, company, role, selected platforms, and message) is transmitted over HTTPS to Web3Forms, which relays it by email to our team inbox. We do not persist form submissions in a database we operate. See our Privacy Policy for full detail on what is collected, why, and how long it is retained.

4. Scope of this policy

This responsible disclosure policy covers:

• The production website at xplug.in and its pages (including product pages such as XPlug.Vision, XPlug.SmartNotifier, and AlarmResponder, and the technical blog);
• Any subdomain of xplug.in that we control and is reachable at the time of testing.

This policy does not cover the internal systems, infrastructure, or products of our clients, even where an Xplug.in-built plugin runs inside them — vulnerabilities in a client's own deployment should be reported to that client directly, in line with their own disclosure process. It also does not cover the platforms of our infrastructure providers (Cloudflare, Vercel, Web3Forms, Google) — please report those directly to the relevant provider.

5. Reporting a vulnerability

If you believe you have found a security vulnerability affecting xplug.in, please report it to us privately before any public disclosure:

• Email contact@xplug.in with the subject line "Security Disclosure".
• Please include: a clear description of the vulnerability and its potential impact, step-by-step reproduction instructions, the URL(s) and account/browser context involved, and any proof-of-concept code, request/response captures, or screenshots that help us verify and reproduce the issue.
• Please do not include real personal data belonging to third parties in your report or proof of concept.
• If you would like acknowledgement of your report, let us know how you'd like to be credited (see Section 9).

We do not currently operate a public bug bounty program or a dedicated PGP key for encrypted reports; if your report contains highly sensitive details, let us know in your initial email and we will agree on a secure way to exchange further information.

6. Safe harbor for good-faith research

We support good-faith security research and will not pursue legal action against, or refer to law enforcement, any researcher who:

• Makes a genuine, good-faith effort to avoid privacy violations, data destruction, and interruption or degradation of the Site;
• Only interacts with test accounts or their own data, and does not access, modify, or exfiltrate data belonging to other users beyond the minimum necessary to demonstrate the vulnerability;
• Does not exploit a vulnerability beyond what is necessary to confirm it exists (e.g. no lateral movement, no persistence, no pivoting to other systems);
• Gives us a reasonable opportunity to investigate and remediate an issue before any public disclosure (we ask for at least 90 days from acknowledgement of a valid report, or until a fix is shipped, whichever comes first); and
• Complies with all other terms of this policy.

We consider activity consistent with this policy to be authorised for the purpose of applicable computer-abuse laws, and we will make that context clear to any relevant third party if the question ever arises. This safe harbor does not extend to activity that falls under Section 7.

7. Out-of-scope activity

The following are not authorised under this policy and are not eligible for safe harbor or recognition:

• Any denial-of-service (DoS/DDoS) testing, load testing, or automated scanning that materially degrades Site performance or availability for other visitors;
• Social engineering, phishing, or physical-security attempts against Xplug.in personnel, contractors, or facilities;
• Spamming the contact form or email inbox as a means of "testing" it;
• Accessing, downloading, modifying, or deleting data that does not belong to you, beyond the minimum needed to demonstrate a vulnerability;
• Any attempt to access a client's own VMS deployment, credentials, or infrastructure — that is out of scope entirely and must be reported to the client directly; and
• Publicly disclosing a vulnerability before we have had a reasonable opportunity to remediate it, as described in Section 6.

8. Our response process

Step	Target timeframe
Acknowledgement of your report	Within 2 working days
Initial triage and validity assessment	Within 5 working days
Regular status updates while remediation is in progress	At least every 2 weeks
Remediation of confirmed, valid findings	Prioritised by severity; critical issues addressed as fast as practicable

Because the Site is a small static site with no user accounts and no database of visitor-submitted data, most theoretical web vulnerability classes (e.g. SQL injection, authentication bypass, session hijacking) do not apply to it in the traditional sense; reports are still very welcome for issues such as content-injection, dependency/config misconfiguration, DNS or CDN misconfiguration, information disclosure, or issues with the contact-form integration.

9. Recognition

We do not currently offer monetary bounties. With your permission, we are happy to publicly or privately credit researchers who report a valid, previously unknown vulnerability in accordance with this policy, once a fix has shipped.

10. Security in our client engagements

Beyond the public website, security is core to how Xplug.in builds plugins for VMS platforms: we develop against vendor-published SDKs (Milestone MIP SDK, Genetec SDK) using vendor-recommended authentication and permission models rather than bypassing them, follow the least-privilege principle when a plugin requests access to entities or system resources, and put every plugin through functional and security-relevant testing (including credential handling, input validation at integration boundaries, and update/versioning behavior) before certification and release. The specific security requirements, testing approach, and responsibilities for any client engagement are defined in that engagement's own signed agreement or statement of work — this general statement does not itself constitute a service-level commitment for a specific project.

11. Incident response & breach notification

In the event we become aware of a security incident affecting personal information collected through the Site, we will investigate promptly, take reasonable steps to contain and remediate it, and notify affected individuals and any applicable regulator as required by law and without undue delay, consistent with our obligations under applicable data protection law (including the EU/UK GDPR and India's Digital Personal Data Protection Act, 2023).

12. Changes to this policy

We may update this Security & Responsible Disclosure Policy from time to time as our practices, infrastructure, or legal obligations evolve. We will update the "Effective & last updated" date at the top of this page when we do.

13. Contact us

To report a vulnerability or ask a question about our security practices:

• Email: contact@xplug.in (subject line: "Security Disclosure")
• Studio: Bengaluru, India · Remote globally
• Hours: Monday – Friday, 09:00 – 19:00 IST (reports are still welcome outside these hours and will be triaged the next working day)