Vulnerability disclosure policy
Security at DeXMI
DeXMI supports safety-critical decisions on mine sites, so we treat security findings as first-class engineering work. If you believe you have found a vulnerability in anything we operate, we want to hear about it, and we commit to the response targets below.
Last updated 19 October 2026
Reporting
How to report a vulnerability
Email security@dexmi.ai. Please include the affected host or feature, steps to reproduce, the impact you believe it has, and how we can reach you. Screenshots or a short proof of concept help; exfiltrated data does not — stop at the minimum needed to show the issue exists.
The machine-readable version of this policy is published at /.well-known/security.txt.
Scope
What is in scope
- www.dexmi.ai and the DeXMI application served from it
- data-core.dexmi.ai (DeXMI Data Core)
- The APIs behind those hosts
AI issues in scope
- Prompt injection, direct or indirect (through an uploaded file, a knowledge-base document or a web result), that makes the assistant act beyond the signed-in user’s access
- Data exfiltration through the assistant’s answers or the links in them
- Retrieval of another organisation’s or another user’s data through the assistant
- Tool misuse, including a change to DeXMI Data Core without the user’s confirmation and an administrator’s approval
Out of scope
- staging.dexmi.ai and staging.data-core.dexmi.ai, our pre-release test environments
- Denial-of-service, load or volumetric testing of any kind
- Social engineering, phishing or physical attacks against our people, customers or suppliers
- Third-party services we build on (AWS, GitHub, Atlassian, model providers), including a model provider’s own model behaviour — please report those to the provider
- Jailbreaks or offensive output with no security impact
- Issues that only exist for an account you are not authorised to use; never access, modify or retain customer data beyond what is needed to demonstrate the issue
Our commitments
What you can expect from us
| Acknowledgement of your report | Within 2 business days |
| Triage and severity assessment | Within 5 business days |
| Progress updates while a fix is in flight | At least every 14 days |
| Confirmation when the fix is deployed | Same day as the deploy |
Remediation targets
Once a report is confirmed we rate it Critical, High, Medium or Low and work to these targets. They are the same targets we apply to vulnerabilities found by our own scanning, which runs on every code change and nightly against production.
| Critical | Mitigated within 48 hours |
| High | Fixed within 14 days |
| Medium | Fixed within 90 days |
| Low | Next scheduled release |
We do not run a paid bug bounty. With your permission we will credit you when the fix ships.
Safe harbour
Good-faith research is welcome
If you make a good-faith effort to follow this policy we will not pursue or support legal action against you for your research, and we will work with you rather than against you. Good faith means: you stay within scope, you do not degrade our service or access data that is not yours, you report promptly, and you give us reasonable time to fix the issue before disclosing it.
Coordinated disclosure
How and when findings are published
We ask for 90 days from your report before public disclosure, or until a fix is deployed, whichever comes first. Where a confirmed vulnerability affects software our customers run themselves, we issue a security advisory to those customers with the affected versions, the fix and any interim mitigation. Vulnerabilities in the third-party components we ship are tracked and patched through our weekly vulnerability triage.