Security & Vulnerability Disclosure

How to report

E-mail us at hello@crevoro.com. Please include a description of the vulnerability, the affected service or URL, reproduction steps and the potential impact. Do not send sensitive data or credentials in the first message.

A machine-readable contact is also published in /.well-known/security.txt.

What we expect

• act in good faith and avoid harming users, data or service availability;
• do not access or store other people’s accounts or data;
• give us reasonable time to assess and remediate before public disclosure.

How we respond

We will acknowledge receipt, assess the vulnerability and take remediation steps as needed. Where necessary we will contact you for more information.

CREVORO does not currently operate a bug-bounty programme and does not publish a binding response-time commitment beyond this description.