Support & contact

Channels

What to include in bug reports

Email developers@quantumelixir.tech with:

1. The x-quantum-request-id header value from the response. We use this to find your request in our logs.
2. Full request (with the API key value redacted, but include scopes and prefix).
3. Full response (status, headers, body).
4. What you expected vs what happened.
5. Steps to reproduce if it's deterministic.

Don't send:

• Production database dumps.
• Real customer PII (NIK, full name, phone). Sanitize or use sandbox.
• Screenshots that include unredacted API keys.

Bug-bounty / responsible disclosure

We run a private bug-bounty. To participate:

1. Email security@quantumelixir.tech with your report.
2. Don't publicly disclose until we've had 90 days to fix (or sooner with mutual agreement).
3. Don't test against production with real customer data — sandbox only.
4. Findings are paid out per severity (CVSS-aligned):
   • Critical (RCE, auth bypass): IDR 100M+
   • High (PII exfil, privilege escalation): IDR 20-50M
   • Medium (CSRF, info disclosure): IDR 5-15M
   • Low (UI bugs, weak config): swag + acknowledgement

PGP key for security@quantumelixir.tech: fingerprint 4D2E B7F0 9A45 1234 .... Full key at https://quantumelixir.tech/.well-known/security.txt.

In-product support

The dashboards for each product include a built-in support widget — bottom-right corner. For non-emergency questions, this is faster than email: the widget routes to the right team based on the page you're on.

Office hours

Weekly developer office hours: Wednesday 14:00 WIB.

We host an open Zoom call where the integrations team takes live questions for an hour. Drop in. The week's agenda is posted Monday morning to the Quantum Elixir Developer Slack (DM developers@quantumelixir.tech for an invite).

Status communication

For production incidents:

1. status.quantumelixir.tech updates within 5 minutes of detection.
2. Subscribed orgs get email within 10 minutes.
3. Severity-1 incidents also get a phone call to the org's listed primary contact (set this on the org settings page).

We never DM or call customers about anything other than real production incidents. If someone claiming to be from Quantum Elixir contacts you about a "security upgrade" or "key migration," it's not us — verify by emailing security@quantumelixir.tech.