Vulnerability disclosure

moatid · coordinated disclosure

How to report

Email architect@exlegacy.com with:

• Affected URL or face
• Steps to reproduce
• Observed impact

Machine-readable contact: /.well-known/security.txt

Scope

• Production hosts we operate for this face
• Auth, data isolation, and secret-exposure findings

Out of scope

• Social engineering
• DoS volume testing without written approval
• Third-party services we do not control