Security
Vulnerability Disclosure Policy
Last updated: 5 August 2026
Convira takes the security of the platform and the data entrusted to it seriously. This page is the canonical policy for reporting a vulnerability in any part of the Convira product: the API, the desktop app, the marketing site, our published packages, and the infrastructure behind them. It is the policy named in our security.txt (RFC 9116).
1. How to report
Email security@convira.ai. If the issue is too sensitive to send in plaintext, say so in your first message and we will set up an encrypted channel with you before you share details.
Please include:
- A clear description of the issue and the impact you believe it has.
- Reproduction steps. A minimal proof-of-concept is ideal; a video or screenshot is fine.
- The affected component: the API, the desktop app, the marketing site, a specific package, or an integration.
- The earliest version where you observed it, if known.
- Your name or handle, if you would like credit in the acknowledgments below.
Do not open a public GitHub issue, pull request, or discussion for security reports. Doing so may put other users at risk while we work on a fix.
If you have not heard from us within 7 days of your initial report, please re-send and CC founders@convira.ai. Mail delivery failures are the most common reason for silence.
2. Scope
In scope:
- convira.ai, app.convira.ai, api.convira.ai, and any other production subdomain we operate.
- The Convira desktop application (the macOS, Windows, and Linux builds we publish).
- The packages we publish under the Convira name.
- The agent runtime, tool registry, sandbox enforcer, and policy engine.
Out of scope:
- Findings against forks, third-party hosts, or self-built variants of the desktop app.
- Social engineering, physical attacks, or attacks against our employees outside of in-product channels.
- Rate limits, brute-force-only findings without a credential-validation impact, or volumetric denial of service.
- Reports generated solely by automated scanners without an exploit narrative.
- Missing security headers on marketing pages where the page has no sensitive surface.
- Vulnerabilities in third-party services we use. Report those directly to the vendor; our subprocessors page lists them.
3. Our commitments
When you report in good faith and under this policy:
- We acknowledge receipt within 2 business days.
- We give a triage decision (accepted, duplicate, out of scope, needs more info) within 5 business days.
- For accepted issues we share a fix timeline. Critical and High severity issues get a fix or mitigation in flight within 30 days; lower severity within 90 days.
- We will not pursue legal action against researchers who follow this policy in good faith.
- With your permission, we credit you in the acknowledgments below once the fix ships.
We do not run a paid bug-bounty program today. If that changes, this page will say so first.
4. Severity guidance
We classify reports using a CVSS-style rubric:
| Severity | Examples |
|---|---|
| Critical | Pre-auth remote code execution, SSRF that reaches cloud metadata, cross-tenant data exfiltration, billing fraud, signing-key compromise, sandbox escape with shell. |
| High | Auth-required remote code execution, privilege escalation across roles, SSRF to internal services, full account takeover, persistent jailbreak that bypasses our policy engine. |
| Medium | Reflected XSS in an authenticated surface, IDOR with limited scope, missing rate limit on a sensitive endpoint, prompt injection that bypasses one defense layer but is caught by another. |
| Low | Open redirect with no chained impact, information disclosure of non-sensitive data, missing HTTP security header on a non-sensitive surface. |
5. Safe harbor
The following are explicitly permitted while researching under this policy, as long as you stay within scope and stop the moment you have proof of impact:
- Creating test accounts and inviting test workspaces.
- Using your own paid subscription to exercise paid surfaces.
- Decompiling or running the published desktop binaries on hardware you own.
Not permitted:
- Accessing or exfiltrating data belonging to anyone other than yourself or accounts you control.
- Modifying or destroying data.
- Running automated traffic that degrades availability for other users. Load testing requires our written permission.
- Persisting access past the point needed to demonstrate impact.
6. Coordinated disclosure
We prefer coordinated disclosure. Please give us 90 days from acknowledgment to ship a fix before public disclosure. For severe issues we may ask for an extension, and we will keep you updated either way.
7. Acknowledgments
Researchers who report valid issues are credited here once the fix is live, unless they request anonymity. No reports have qualified yet; the first name on this list will have earned it.
Thank you for helping keep Convira and the people who rely on it safe. For how the product protects data day to day, see the Security page.