Responsible Disclosure

Email hello@clavix360.app with:

• A clear description of the issue;
• Steps to reproduce, including any proof-of-concept;
• The URL or component affected;
• Your contact information so we can follow up.

Please use a secure channel and avoid posting details publicly until we have had a reasonable opportunity to respond.

In scope:

• clavix360.app and its sub-domains we own;
• The Clavix360° platform and its public APIs.

Out of scope:

• Third-party services we integrate with (please report to that vendor);
• Social-engineering attacks against our staff or customers;
• Denial-of-service or volumetric tests;
• Issues that require physical access to a user's device.

If you act in good faith, comply with this policy and avoid privacy violations, data destruction and service disruption, we will not pursue legal action for your research and will treat your report confidentially. Authorisation does not extend to acts that violate applicable law.

Please do not:

• Access, modify or delete data that is not your own;
• Exfiltrate any data beyond what is necessary to demonstrate the issue;
• Disrupt the service, run brute-force attacks or load tests;
• Use automated scanners that generate excessive traffic without prior coordination;
• Engage in social engineering or physical security testing.

We aim to:

• Acknowledge your report within five business days;
• Triage and provide a status update within ten business days;
• Keep you informed as we investigate and remediate.

We do not currently operate a paid bug-bounty programme; with your permission we are happy to publicly acknowledge meaningful contributions in a hall-of-fame style.

hello@clavix360.app — Clavix360.app, Ottawa, Canada.