Security
Report a security issue
If you have found a way to read, change or reach something in MoxiVue that should not be possible, tell us privately first. We will work with you and credit you if you wish.
Machine-readable contact: security.txt.
How to reach us
Write to security@moxivue.com. Say what you found, how to reproduce it and which version it affects. Please do not use the in-app report form for this, and do not post it in public before we have had time to fix it.
In scope
- The MoxiVue apps and packages for Linux: the window, the console service, the machine agent, the root executor, the read-only helper and the command line.
- The Dispatcher service at
dispatcher.moxivue.com(andrelay.moxivue.com, its earlier name), including sign-in, and the two witnesses atwitness.moxivue.comandwitness2.moxivue.com. - The protocol and encryption between your devices, and anything that lets the Dispatcher or another account read or change what it should not.
- This website and the package repository at
get.moxivue.com, including the signing of packages.
Out of scope
- Flooding or exhausting our servers (denial of service), and automated scanning that produces heavy traffic.
- Systems that are not part of MoxiVue.
- Services run by others that we use. Report those to their owners.
- Social engineering, physical access to someone's machine, and problems that need an already compromised machine or account (a way for a device to go beyond its role or place is in scope).
- Missing best-practice headers or settings without a way to exploit them.
Ground rules
- Test only with accounts and machines that are yours.
- Do not read, change or delete anyone else's data. If you come across some by accident, stop and tell us.
- Do not disturb the service for others.
- Give us a reasonable time to fix the problem before you publish it; we aim for 90 days at most and will tell you if we need longer.
What we promise
If you follow this page in good faith, we treat your work as authorised and welcome it. We will keep you informed, credit you in the notes of the fixed version if you want that, and not share your name without your consent. There is no paid reward programme yet.
When to expect an answer
- A first reply from a person: we aim for 5 working days.
- Our assessment, and a plan if it is a vulnerability: we aim for 14 days.
- A fix for a serious problem: as fast as we can test it; we aim for 30 days. Fixes reach users through the signed package repository.
MoxiVue is run by a very small team. These are the times we work to, not guarantees; if we need longer we will tell you.