Found something?
We want to know.

SecurityVault runs a coordinated vulnerability disclosure programme. Reports are acknowledged within two business days, and we take no legal action against good-faith research.

security@securityvault.io Scope & rules

How to report

What should a report include?

Email security@securityvault.io. Our security.txt carries the same contact.

Where

The affected host, URL, endpoint or component.

What

The vulnerability class, its impact and the conditions needed to exploit it.

How

Step-by-step reproduction, with requests, payloads or a proof of concept. Use only test data and accounts you control.

Who

How you would like to be credited, or that you prefer to stay anonymous.

Scope

What is in scope, and what is not?

Test only against assets you control. Do not touch other tenants. Do not exfiltrate data.

In scope

securityvault.io, the website
app.securityvault.io, the application
api.securityvault.io and the public API
The esos CLI and the SDKs we publish
Scanning, result ingestion and the audit log
Authentication, SSO and outbound SCIM sync
Isolation between customer tenants

Out of scope

Internal tooling and systems not offered to customers
Social engineering of staff or customers
Physical attacks against offices
Denial of service or rate-limit testing
Spam on marketing pages
Vulnerabilities in third-party services
Issues already published or under embargo

Good-faith research

What do we ask of researchers?

Our promise

We take no legal action against research carried out in good faith under this policy.

Your part

Do not access data that is not yours, do not degrade the service, and stop and tell us as soon as you reach another customer's data.

Publication

Give us reasonable time to fix the issue before publishing, and coordinate the timing with us.

Response targets

How quickly do we respond?

Every report is acknowledged within two business days. Triage targets depend on severity.

Severity	Acknowledgement	Triage target
Critical Remote code execution, auth bypass, evidence forgery	2 business days	72 hours
High Privilege escalation, crossing a tenant boundary	2 business days	7 days
Medium SSRF, IDOR, business logic	2 business days	30 days
Low Information leak, hardening	2 business days	Best effort

Recognition

Do you pay bounties?

We do not run a paid bug bounty programme. With your agreement, we credit reporters by name; anonymous reports are welcome.

Report

Send us what you found.

Reports go straight to the engineers who build the platform. For how SecurityVault is secured, read the security overview.

Email security@securityvault.io Security overview

Found something?We want to know.