# Axis Security Policy

Last updated: June 9, 2026

Axis is built to coordinate real user data, authenticated sessions, and shared project state. Security issues matter here because they can expose project content, session history, API keys, or org-scoped data.

## Scope

This policy covers the public Axis web app at `useaxis.dev`, the hosted MCP endpoint, and the associated API routes and data models that back them.

## What We Care About

- Unauthorized access to user accounts, orgs, projects, sessions, or API keys
- Cross-user or cross-org data leakage
- Session spoofing, privilege escalation, or auth bypass
- RLS bypasses, broken access control, or unsafe service-role usage
- Injection bugs, XSS, CSRF, SSRF, or open redirect issues
- Secrets exposed in logs, UI, metadata, or downloadable artifacts

## Reporting

If you believe you found a vulnerability, report it through the Axis support or feedback channel on the site, or open a private report if that is available in the current GitHub setup.

Please include:

- a clear description of the issue
- the affected URL, route, or workflow
- steps to reproduce
- your expected result vs the actual result
- any proof-of-concept details you are comfortable sharing

## Responsible Disclosure

- Do not publicly disclose the issue until it has been reviewed and a fix has been released, or until you have explicit permission.
- Avoid destructive testing, data exfiltration, or actions that affect other users.
- If the issue requires broad verification, keep the blast radius minimal and use test data only.

## What We Will Do

- Acknowledge receipt and triage the report
- Confirm impact and scope
- Patch the issue or mitigate it
- Credit the reporter when appropriate

## Notes

Axis uses authenticated API routes, Supabase row-level security, and server-side service credentials for privileged actions. If you are reviewing the system, focus on whether those boundaries can be bypassed in practice.