Security

Report a security issue

If you think you have found a vulnerability in an XTen site or product, tell us. We would rather hear it from you first.

How to report

Email security@xten.au with what you found, where, and how to reproduce it. If it involves personal information or credentials, please encrypt it with the key below. Please don't access, change or keep other people's data, and give us reasonable time to fix the problem before you publish anything.

The same details are machine-readable at /.well-known/security.txt.

PGP key

Identity
XTen Security <security@xten.au>
Type
Ed25519 (sign, certify) with a Curve25519 encryption subkey
Fingerprint
C495 0452 4552 E24F 7FB4  1FB4 A539 C58B FDF8 97C9
Expires
26 October 2028; the key is renewed or replaced before then and the new fingerprint is published here

Download the public key (also at /.well-known/pgp-key.txt). Check the fingerprint above against the key you download.

Last updated 28 October 2026.