Responsible Disclosure
Found a vulnerability in SoundLink, the docs site, or any studio project? Thank you — here's how to report it safely and what happens next.
Scope
- SoundLink (dxn1-soundlink / soundlink11 / soundlink1 domains)
- Docs & contact site (DXN1 Studios-docs / dxn1-docs)
- Public repositories under DXN1-t and DXN1-termux
Rules of engagement
- Do not access, modify, or delete other users' data.
- Do not run automated scanners that hammer production.
- Do not publicly disclose before we've had a chance to fix (we aim for fast fixes).
- No social engineering, no physical testing.
- Stop if you hit something sensitive and report it instead.
How to report
Subject: "Security vulnerability". Include steps to reproduce, impact, and your contact.
Security reports skip the queue — the owner sees them immediately.
We respond fast, fix, and confirm what was done. No legal threats for good-faith reports.
What we ask in return
Reasonable time to fix before public disclosure, and no exploitation beyond proof-of-concept. Good-faith reporters get credit in the changelog and a thank-you in the README.
What we'd love to hear about
- XSS, CSRF, injection, or auth flaws in any studio site or function.
- Data exposure (unintended access to other users' data).
- Misconfigurations (open endpoints, exposed secrets in public repos).
- Rate-limit bypasses used for abuse.
Out of scope
- Third-party services (Netlify, Google, GIF/sound providers) — report to them.
- Self-XSS, social engineering of the CEO, physical attacks.
- DoS/DDoS testing.
Recognition
Valid, first-reported findings get credit in the changelog (unless you want to stay anonymous) We're small; we can't run a bounty pool, but we do right by reporters.
Timeline
- Acknowledgement: within 48 hours.
- Triaged: within 5 business days.
- Fix + disclosure: typically 1–3 weeks depending on severity.
⚖️ Legal basis & applicable law
These are the primary provisions that anchor this page. They are cited as article — statute — jurisdiction so you can verify each one against the official text.
| Provision | What it governs here |
|---|---|
Art. 138ab, Wetboek van Strafrecht (Sr), Netherlands | Why testing is only lawful with authorization — the line our policy respects. |
18 U.S.C. §1030 (CFAA), United States | US equivalent for unauthorized testing. |
CETS No. 185 (Budapest Convention on Cybercrime), Council of Europe | International cybercrime framework; coordinated disclosure avoids it. |