Responsible Disclosure

In Scope

• All *.pyrx.tech domains (crm.pyrx.tech, synapse-app.pyrx.tech, synapse-api.pyrx.tech, synapse-events.pyrx.tech)
• The Synapse REST API and all API endpoints
• Synapse SDKs and client libraries
• Authentication and authorization mechanisms (JWT verification, API key auth, RBAC enforcement)
• Multi-tenant isolation (PostgreSQL Row-Level Security, tenant context middleware)
• The NLT (Natural Language Template) engine (parsing, rendering, XSS prevention)
• Webhook signature verification (Lemon Squeezy, Resend)

Out of Scope

• Third-party services (Lemon Squeezy, Resend, Google Cloud Platform, Sentry) — report issues directly to those vendors
• Corporate email infrastructure
• Physical security of offices or data centers
• Social engineering attacks against PYRX employees or customers
• Denial-of-service attacks
• Automated vulnerability scanning at high volume

PYRX Technologies will not pursue legal action against security researchers who discover and report vulnerabilities in good faith and in accordance with this policy. Good-faith security research conducted under this policy is:

• Authorized under applicable computer fraud and abuse laws
• Exempt from restrictions in our Terms of Use that would otherwise prohibit security testing
• Conducted to improve the security of the Synapse platform for all users

If at any point you are uncertain whether your research is consistent with this policy, please contact us at [email protected] before proceeding.

Send vulnerability reports to [email protected]. Please include the following information:

• A clear description of the vulnerability
• The type of issue (e.g., XSS, SQL injection, authentication bypass, tenant isolation breach, IDOR)
• The affected asset (URL, API endpoint, SDK version)
• Step-by-step instructions to reproduce the issue
• The potential impact or severity of the vulnerability
• Screenshots, proof-of-concept code, or HTTP request/response logs where applicable

PGP encryption is encouraged for sensitive reports. Our PGP public key fingerprint: [Available upon request at [email protected]]

We will keep you informed of our progress throughout the remediation process.

When conducting security research, you must:

• Only test against accounts you own or have explicit authorization to test
• Stop testing and report immediately if you accidentally access another user's or tenant's data
• Not perform denial-of-service attacks or degrade service availability
• Not use automated scanning tools at high volume against production systems
• Not attempt social engineering against PYRX employees or customers
• Not publicly disclose the vulnerability before we have had a reasonable opportunity to fix it
• Not access, modify, or delete data belonging to other users or tenants
• Not exploit the vulnerability beyond what is necessary to demonstrate the issue

• Good faith — act in good faith to avoid privacy violations, service degradation, and disruption to other users
• Sufficient detail — provide enough information for us to understand and reproduce the issue
• Reasonable time — allow us reasonable time to investigate and remediate before any public disclosure

We appreciate the contributions of security researchers who help keep the Synapse platform safe:

• Security Hall of Fame — with your permission, we will recognize you on our Security page for valid reports
• Letter of appreciation — we provide a formal acknowledgment letter for verified vulnerabilities
• Swag — we may offer PYRX swag for significant findings at our discretion

We do not currently offer a monetary bug bounty program. This may change in the future.

The following issues are generally not eligible under this policy:

• Previously reported or already-known issues
• Spam or social engineering reports
• Cosmetic or UI/UX bugs without security impact
• Missing security headers (e.g., X-Frame-Options, CSP) without a demonstrated exploit
• Self-XSS (attacks that require the victim to paste code into their own browser console)
• Clickjacking on pages with no sensitive actions
• CSRF on forms that do not perform state-changing operations
• Rate limiting or brute force issues without demonstrated account compromise
• Disclosure of non-sensitive information (e.g., server version headers)
• Issues in third-party services or dependencies unless they directly affect Synapse
• Theoretical vulnerabilities without a working proof of concept

For all security-related communications, contact us at:

[email protected]

For non-security inquiries, see our Legal & Privacy hub for the appropriate contact.