Vulnerability Disclosure Policy

We will not pursue legal action against security researchers who act in good faith under this policy. Good faith means: you make a genuine effort to avoid privacy violations, data destruction, and service disruption.

If you follow these guidelines, we consider your research authorized. We will work with you to understand and resolve the issue quickly.

The following are in scope:

• clavitor.ai — the production website
• *.clavitor.ai — all Point of Presence (POP) vault endpoints
• /api/ — the vault REST API
• /app/ — the vault web UI
• clavitor-cli — the agent CLI
• clavitor-proxy — the HTTPS credential proxy
• Browser extensions — Chrome, Firefox, Safari

The following are out of scope:

• Social engineering of staff or users
• Denial of service attacks
• Physical attacks against infrastructure
• Third-party services (Paddle, Cloudflare)
• Automated scanning that degrades service availability

• Do not access, modify, or delete another person's vault data.
• Do not degrade service availability.
• Stop and report immediately if you encounter real user data.
• Give us reasonable time to fix issues before any public disclosure.
• Use the minimum access necessary to demonstrate the vulnerability.

Email security@clavitor.ai. For sensitive reports, encrypt your message with our PGP key.

Include:

• Description of the vulnerability and its potential impact
• Steps to reproduce
• Any proof-of-concept code or screenshots

• Acknowledge your report within 48 hours.
• Provide a meaningful assessment within 7 days.
• Keep you informed as we work on a fix.
• Credit you publicly on our acknowledgments page — unless you prefer to remain anonymous.

We don't run a paid bounty program. We offer our thanks, public credit, and the knowledge that you helped protect real users' private data.