Responsible Disclosure Policy

Last updated: July 4, 2026

Augment d.o.o. (operating as “Eulex”) welcomes reports from security researchers who find a genuine vulnerability in our systems. This page describes what’s in scope, how to report, and what you can expect from us in return.

Scope

This policy covers:

eulex.ai and its subdomains (including max.eulex.ai and mcp.eulex.ai), and
the Eulex application and API — the platform described at eulex.ai.

Third-party services we depend on (see the Subprocessor List) are out of scope; report vulnerabilities in those services directly to their operators.

Safe harbour

If you make a good-faith effort to comply with this policy while researching a vulnerability, we will not pursue legal action against you for that research. Good faith means:

you avoid privacy violations, service disruption, and destruction of data;
you only interact with accounts and data you own, or that you have explicit permission to test;
you give us a reasonable opportunity to investigate and remediate before disclosing publicly; and
you do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability.

How to report

Email [email protected]. Include:

a description of the vulnerability and its potential impact;
steps to reproduce, including the URL, endpoint, or component affected;
any proof-of-concept code, request/response samples, or screenshots; and
your contact details, so we can follow up with questions.

Please report in English or Croatian.

What to expect from us

Acknowledgement within 3 business days of your report.
A status update within 14 days, including our assessment of severity and, where possible, an expected remediation timeline.
Credit in our release notes, if you’d like it, once a fix ships.

We do not currently run a paid bug bounty program. We do not offer financial rewards for reports at this time, but we take every genuine report seriously and will keep you informed as we work through it.

What not to do

Please don’t:

test against other customers’ data or accounts without their permission;
run automated scanners that could degrade service for other users;
publicly disclose a vulnerability before we’ve had a chance to address it; or
attempt social engineering against our staff, contractors, or customers.

Reports that fall outside this policy, or that involve intentional harm, will be handled as a security incident rather than a disclosure.