Vulnerability Disclosure Policy

1. Introduction

Cyrex is an offensive security company and the developer of Deus Rex, an AI pentesting agent.

2. Scope

This policy covers:

• Vulnerabilities in all Cyrex products, including Deus Rex.
• Vulnerabilities in open source software reported to or discovered by Cyrex, including by Deus Rex.

This policy does not cover:

• CVE ID assignment for products covered by another CNA, such as the vendor's own. We request the CVE ID from that CNA.
• Vulnerabilities found during client engagements. These are confidential and disclosed only with the client's written consent.
• Reports with no security impact, such as functional bugs, missing hardening or unverified scanner output.

3. Reporting a Vulnerability

Send your report to disclosure@cyrex.tech. To encrypt it, use our PGP key at https://cyrex.tech/pgp-key.txt.

Please include:

• The affected product or project and the affected versions.
• A description of the vulnerability and its impact.
• Steps to reproduce it or a proof of concept.
• Whether you have reported it to anyone else or requested a CVE ID for it.
• How you would like to be credited.

If you used automated or AI tools, please tell us and confirm that you have verified the finding. You may report anonymously. Reports should be in English.

4. Response Times

We aim to:

• Acknowledge your report or CVE ID request within 3 business days.
• Tell you within 10 business days whether we have validated the vulnerability.
• Notify the affected maintainer or vendor within 5 business days of validation.
• Keep you informed until the vulnerability is disclosed.

5. Requesting a CVE ID

You can ask us to obtain a CVE ID for a vulnerability covered by this policy. We reproduce the vulnerability, coordinate disclosure with the maintainer and request the CVE ID from the CNA that covers the product, or from MITRE where no CNA covers it. We send you the ID once it is assigned.

Your testing must be lawful and, on systems you do not own, authorised by their owner. We do not ask you to accept any terms that restrict what you publish or when. If we decline a request, we explain why and, where possible, refer you to the appropriate CNA.

6. How CVE IDs Are Assigned

A CVE ID is assigned when there is reasonable evidence of a vulnerability with a security impact, the vulnerability is in the assigning CNA's scope and it has been or will be publicly disclosed. Each independently fixable vulnerability receives its own CVE ID. A vulnerability can still receive a CVE ID when the affected product or version is end-of-life or unmaintained and no fix will be released.

7. Vulnerabilities We Discover

Our security researchers verify every finding, including those from Deus Rex, before we contact a maintainer. We report privately from research@deusrex.ai and state when a finding was identified with AI assistance.

8. Coordinated Disclosure

All periods in this section are calendar days.

• We disclose a vulnerability once a fix is released or 90 days after our first report to the maintainer, whichever comes first.
• A maintainer who is actively working on a fix may request one 30-day extension before day 90.
• If a maintainer does not respond, we try other contacts and may involve a national CSIRT or CERT/CC before disclosing at 90 days.
• If a vulnerability is being actively exploited, we may disclose 7 days after our report to the maintainer.
• If details become public earlier, we may disclose without waiting.

At disclosure, we publish an advisory describing the affected versions, the impact and how to remediate the vulnerability. Technical details and proof-of-concept code follow no earlier than 30 days after a fix is available.

9. Advisories & CVE Records

Our advisories are published at https://cyrex.tech/advisories. Each advisory includes its CVE ID and a CVSS v4.0 score, or a v3.1 score where no v4.0 score is available, and matches its CVE Record. Advisories can be read without charge or registration and may be reused freely. Where the CVE Record is ours to publish, we normally publish it within 24 hours of disclosure, and no later than 72 hours, and update it when information changes, for example when a fix becomes available.

10. Recognition

We send reporters the CVE ID for the vulnerability they reported and credit them in our advisories and CVE Records by name, by handle or anonymously, as they prefer.

11. Safe Harbour

We will not take legal action against anyone who researches vulnerabilities in Cyrex products in good faith and in line with this policy. Good faith means you:

• Avoid causing harm to Cyrex, our customers and their data.
• Access only the data needed to demonstrate the issue.
• Do not carry out denial-of-service, social engineering or physical attacks.
• Report the vulnerability to us promptly.

This policy does not authorise testing of third-party systems.

12. Disputes & Corrections

To dispute a decision or a CVE Record we published, email disclosure@cyrex.tech. If we cannot resolve it, the CVE Program's dispute process applies.

13. Updates to This Policy

We review this policy at least once a year.