Vulnerability Disclosure

We take security seriously. This Vulnerability Disclosure Policy explains how security researchers and users can report vulnerabilities in Pyvorin Portal and the Pyvorin compiler platform.

1. Scope

This policy covers the Pyvorin web application, API, compiler platform and related infrastructure operated by us. Testing should be limited to your own accounts and data unless we have explicitly agreed otherwise.

2. How to report

Send reports to support@pyvorin.com with the subject "Security vulnerability report". Please include:

A clear description of the vulnerability and its potential impact.
Steps to reproduce, including any proof-of-concept code.
The affected systems, URLs or endpoints.
Your contact details and preferred disclosure timeline.

3. Safe conduct

When investigating vulnerabilities, you must:

Not access, modify, delete or exfiltrate data that does not belong to you.
Not disrupt the availability of the Service or other users.
Not use automated scanners that generate excessive traffic.
Not publicly disclose the vulnerability until we have had a reasonable time to address it.

4. Our commitment

We will acknowledge receipt of your report promptly, investigate in good faith, and keep you informed of progress. We will not take legal action against researchers who comply with this policy and who act in good faith.

5. Recognition

With your consent, we may publicly recognise your contribution once the vulnerability is resolved. You are not entitled to compensation, but we welcome responsible disclosure.

6. Out-of-scope conduct

The following remain prohibited: social engineering, physical attacks, denial-of-service attacks, testing that degrades service for other users, and any activity that violates applicable law.