Security and responsible disclosure
How Maxx protects accounts and money, and how to report a vulnerability safely.
How Maxx protects you
- Sign-in: passkeys, authenticator apps, emailed one-time links, and Google, Apple, Microsoft or GitHub. Passwords are hashed with scrypt and checked against known breaches without being sent anywhere.
- Sessions are in HttpOnly, SameSite cookies with idle and absolute limits. Sensitive changes ask you to confirm your identity again.
- Requests that change anything must come from Maxx itself, and the page’s Content-Security-Policy only allows Maxx’s own scripts.
- Authenticator secrets and delivery addresses are encrypted at rest. Seller private terms never leave the server.
- Money: Maxx never sees card details. Every payment call is idempotent, limits cap what can be held, payments can be paused instantly, and every money decision is written to an audit log.
- Seller payouts go only to an email address the seller has confirmed, and a changed address waits before being paid.
Report a vulnerability
Email security@maxx.example with what you found, how to reproduce it, and its impact. We will acknowledge within 3 business days and keep you updated. See the security.txt file at /.well-known/security.txt.
Please give us reasonable time to fix an issue before you make it public, and do not access, change or delete other people’s data.
Scope and safe harbour
- In scope: the Maxx web app and API, including account, payment, seller and order features.
- Out of scope: social engineering of staff or users, physical attacks, denial of service, spam, and the sandbox or systems of PayPal, Nebius, Tavily and other providers. Report those to the provider.
- Test only with accounts you own, and do not run automated scanners that generate heavy traffic.
If you act in good faith and within this policy, we will not take legal action against you and will work with you to fix the issue. We do not currently run a paid bounty, but we are glad to credit you.
What you can do
- Add a passkey or an authenticator app from Account settings.
- Use a unique password from a password manager.
- Check Account settings for sign-in activity you do not recognise, and sign out other devices.
- Never share a sign-in code. Maxx staff never ask for one.