Responsible Vulnerability Disclosure

We are grateful to security researchers who help keep members safe. We commit to coordinated disclosure, in good faith.

How to report

• Email security@civicvault.org with technical detail, reproduction steps, and impact assessment.
• Please avoid automated scanning, denial-of-service, or actions that compromise member data.
• Use an in-scope test account; do not create data that could harm other members.

Our response timeline

• Acknowledgment within 48 hours.
• Triage & severity assessment within 7 days.
• Fix target: critical 30 days; high 90 days; other issues best-effort scheduling.
• Public disclosure coordinated with the researcher after remediation.

Scope

• In scope: the web application, member APIs, admin APIs, authentication and authorization boundaries, device/session management.
• Reported cryptographic design flaws are treated as critical.