XIUI Digital Technology Co., Ltd.

Vulnerability Disclosure Policy

If you find a security issue in xiui.tw or an online service operated by XIUI Digital Technology, please tell us directly. We treat good-faith reports as help, not as attacks.

How to report

• Email security@xiui.tw, in English or Chinese.
• Include the affected URL or service, steps to reproduce, and the impact you expect; screenshots or request logs help.
• Machine-readable contact details are at /.well-known/security.txt.

What we commit to

• We reply within three business days to confirm receipt and that we are looking into it.
• Once confirmed, we tell you how we plan to handle it and keep you updated until the fix is live.
• After the fix, we credit you publicly with your consent; you may also stay anonymous.

What we ask of you

• No denial-of-service, brute-force or any testing that affects other users.
• Do not access, download or modify data that is not yours; if you obtain it by accident, stop immediately and say so in your report.
• No social engineering, phishing or physical intrusion against our staff or clients.
• Do not publish details before the fix is in place.

Good-faith research

We will not take legal action against security research conducted in good faith within the boundaries above. This policy covers only xiui.tw and services operated by XIUI itself; authorized testing we perform for clients is governed by each engagement contract and is outside the scope of this page.

Last updated: 2026-10-11.