Security & Responsible Disclosure

How to report a security vulnerability to QYVORA, what is in scope, our safe-harbour commitment, and what you can expect from us.

Report a vulnerability

Send reports privately to the security desk with the subject "Security report". Include a clear description, reproduction steps, impact, and a short proof of concept that does not damage data or disrupt service.

In scope

qyvora.org and its public pages, the QYVORA API, authentication and account flows, the credential registry and verification flow, and QYVORA-owned open-source tools.

Out of scope

Social engineering, physical attacks, denial-of-service, automated high-volume scanning, accessing other users’ data, third-party services, and public disclosure before a coordinated date.

Safe harbour

Good-faith research that follows this policy will not lead to legal action from QYVORA for the research itself. Do not access, retain, or share data that does not belong to you.

Our response

We aim to acknowledge reports within 3 business days and complete initial triage within 10 business days where the report is complete. We prefer coordinated disclosure and will agree a realistic timeline with you.