XPScerpto Portal-3
Security
Sovereign cryptographic platform portal
XPScerpto presents a sovereignty-oriented cryptographic platform portal with explicit authority boundaries, evidence-first status reporting, and a separate editorial control plane.
Evidence-first UI
Security
This portal distinguishes the real Python backend from the native C++ runtime. Claims remain gated by evidence and runtime truth checks.
Truth contract
No unproven production claim
production_ready is computed from native runtime attachment plus qualifying evidence; it is not an editorial toggle.
Security sectionsDisclosure
Coordinated vulnerability disclosure
Security
XPScerpto presents a sovereignty-oriented cryptographic platform portal with explicit authority boundaries, evidence-first status reporting, and a separate editorial control plane.
These limitations are part of the public security posture and are not suppressed.
SAFE_HARBOR_PENDING_LEGAL_REVIEWSafe-harbor language is pending legal review and is not published as an approved protection.RETENTION_POLICY_PENDING_GOVERNANCEThe disclosure retention period is pending governance approval.
01
Authorized scope
Test only the assets listed below and only to the minimum extent needed to demonstrate the issue.
- xpscerpto.eu
02
Outside scope
- Third-party services, networks, repositories, identity providers, mail providers or hosting systems not owned or expressly authorized by XPScerpto.
- Social engineering, phishing, physical intrusion, credential stuffing, denial-of-service and destructive testing.
- Automated scanning that degrades availability or accesses data beyond the minimum proof required.
03
Permitted research
- Use non-destructive techniques and stop after establishing a reproducible proof.
- Use accounts and data you own or are explicitly authorized to use.
- Protect any data encountered and report it immediately without further access.
04
Do not
- Do not perform denial-of-service, destructive testing, social engineering, phishing or credential attacks.
- Do not test third-party infrastructure or services that XPScerpto does not control.
- Do not exfiltrate, retain, modify or publish personal, confidential or security-restricted data.
05
Coordinated handling
- Receipt confirms intake only; it does not validate the vulnerability.
- The security team will scope, reproduce and triage the report before remediation.
- Publication requires redaction, independent verification and explicit advisory approval.
06
Operational expectations
You will receive a reference and private follow-up code immediately. No unverified response deadline is promised. Updates appear in the secure status channel.