1. Our commitment
1.1. LEXXEN LTDA, CNPJ 63.987.111/0001-53, recognizes the value of the work of the security community and maintains an open channel for the responsible reporting of vulnerabilities.
1.2. Anyone who reports in good faith and follows this Policy will not be subject to legal action by Lexxen (section 5).
1.3. This Policy is public and applies to anyone, in Brazil or abroad.
English summary: Lexxen welcomes good-faith security research. Report vulnerabilities to compliance@lexxen.com. Researchers who follow this policy will not face legal action from Lexxen. See Section 5 for the safe harbor terms.
2. Scope
2.1. In scope
- The www.lexxen.com domain and subdomains operated by Lexxen
- Lexxen's web applications and mobile applications
- Lexxen's public APIs
- Infrastructure under Lexxen's direct control
2.2. Out of scope
| Out of scope | Why |
|---|---|
| Partner systems (payment institutions, VASPs, card issuers) | not controlled by Lexxen; report directly to the institution, and we can help make contact |
| Third-party services (cloud, e-mail, CDN providers) | they have their own channels |
| Denial of service attacks (DoS/DDoS) | cause real unavailability for users |
| Social engineering against Team Members, clients or partners | involves people, not systems |
| Physical attacks on facilities | same as above |
| Spam, brute force and high-volume automated testing | degrade the service |
| Reports consisting only of scanner output, with no demonstrated impact | do not constitute a vulnerability |
| Missing headers or best practices without a demonstrable exploit | same as above |
3. Rules of conduct
3.1. When conducting research, you must:
a) act in good faith, with the aim of improving security; b) use only your own accounts or accounts created for testing; c) stop immediately upon gaining access to third-party data, and report it without copying, storing, disclosing or transferring that data; d) limit yourself to the minimum proof of concept necessary to demonstrate the issue; e) avoid any action that degrades the service or affects real users; f) give Lexxen a reasonable period to remediate before any public disclosure.
3.2. You must not:
a) access, modify or destroy data that is not yours; b) exfiltrate data; proof is established with minimal evidence, not with volume; c) use the vulnerability to obtain an advantage, for yourself or for a third party; d) demand payment as a condition for disclosing the flaw; that is not research, it is extortion; e) disclose publicly before the agreed period.
4. How to report
4.1. Send an e-mail to compliance@lexxen.com with the subject [VULN].
4.2. Include:
| Item | Description |
|---|---|
| Type of vulnerability | e.g. XSS, IDOR, authentication flaw |
| Where | affected URL, endpoint or screen |
| Steps to reproduce | step by step, in order |
| Impact | what an attacker would be able to do |
| Evidence | screenshots, requests, short video |
| Contact | how we can reach you (optional if you prefer anonymity) |
4.3. Reports may be submitted in Portuguese or English.
4.4. If the evidence contains third-party personal data, anonymize it before sending and let us know that you have done so.
5. Safe harbor
5.1. Lexxen will not take judicial or extrajudicial action against anyone who, in good faith:
- follows this Policy;
- respects the scope in section 2 and the rules in section 3;
- reports promptly and does not disclose before the agreed period.
5.2. We will consider research conducted on these terms to be authorized access for the purposes of applicable law, including Article 154-A of the Brazilian Penal Code.
5.3. The safe harbor does not apply to anyone who exfiltrates data, causes intentional harm, engages in extortion, uses the flaw for their own benefit or violates the rights of third parties.
5.4. The safe harbor is granted by Lexxen and does not bind third parties: partners, providers or authorities. Testing third-party systems is the responsibility of the person testing.
6. Our timeframes
| Stage | Timeframe |
|---|---|
| Acknowledgment of receipt | up to 3 business days |
| Initial triage and classification | up to 10 business days |
| Feedback on validity and remediation plan | up to 20 business days |
| Remediation, critical severity | up to 15 calendar days |
| Remediation, high severity | up to 30 calendar days |
| Remediation, medium and low severity | according to planning, communicated to the researcher |
6.1. We will keep the researcher informed of progress and will notify them when remediation is complete.
6.2. If we need more time, we will explain the reason and propose a new date.
7. Public disclosure
7.1. We ask for 90 days between the report and any public disclosure, or until remediation, whichever occurs first.
7.2. We are open to coordinated disclosure and to agreeing on a different period on a case-by-case basis.
7.3. With your authorization, we may publicly acknowledge your contribution. If you prefer anonymity, we will respect it.
8. Rewards
8.1. Lexxen does not currently maintain a financial reward program (bug bounty).
8.2. We recognize significant contributions through public acknowledgment, when authorized, and a letter of recognition upon request.
8.3. If a reward program is established in the future, this Policy will be updated.
9. Personal data
The researcher's contact data is processed in order to conduct the analysis and respond, in accordance with the Privacy Policy, at www.lexxen.com/privacy.
10. Contact
compliance@lexxen.com, subject [VULN]
For an ongoing incident affecting users, use the same address with the subject [VULN-URGENT].
LEXXEN LTDA, CNPJ 63.987.111/0001-53 Goiânia/GO, August 31, 2026, version 1.0