generated: '2026-08-12'
method: probed
source: >-
  probe-security-programs.py pixis ; /.well-known/security.txt probed on pixis.ai,
  app.pixis.ai, prism.pixis.ai, prism-docs.pixis.ai and auth.pixis.ai
name: Pixis — vulnerability disclosure
description: >-
  Pixis publishes no vulnerability disclosure programme. Recorded as an explicit negative so a
  reader knows the absence was measured, not skipped.

program:
  present: false
  policy_url: null
  contact: null
  bug_bounty: null
  platform: null
  safe_harbor: null
  pgp_key: null

evidence:
  - url: https://pixis.ai/.well-known/security.txt
    status: 200
    document: false
    note: WordPress HTML 404 shell served with a 200 status. Not a security.txt.
  - url: https://auth.pixis.ai/.well-known/security.txt
    status: 404
    document: false
  - url: https://prism-docs.pixis.ai/.well-known/security.txt
    status: 404
    document: false
  - url: https://app.pixis.ai/.well-known/security.txt
    status: 200
    document: false
    note: Firebase SPA shell served with a 200 status.

searched_for:
  - security.txt (RFC 9116) on every Pixis host
  - HackerOne / Bugcrowd / Intigriti programme
  - /security, /trust, /responsible-disclosure pages (absent from the pixis.ai sitemap)
  - a security contact on https://pixis.ai/contact/

note: >-
  The only published contact route is the general contact form at https://pixis.ai/contact/ and
  support@pixis.ai. Neither is designated for security reports.