Vulnerability Disclosure Policy

1. How to report

Email security@convira.ai. If the issue is sensitive enough that you do not want to send it in plaintext, request our PGP key in the first message and we will reply with a fingerprint and key block.

Please include:

1. A clear description of the issue and the impact you believe it has.
2. Reproduction steps. A minimal proof-of-concept is ideal; a video or screenshot is fine.
3. The affected component: the API, the desktop app, the marketing site, a specific package, or an integration.
4. The earliest version where you observed it, if known.
5. Your name or handle, if you would like credit in the acknowledgments below.

Do not open a public GitHub issue, pull request, or discussion for security reports. Doing so may put other users at risk while we work on a fix.

If you have not heard from us within 7 days of your initial report, please re-send and CC founders@convira.ai. Mail delivery failures are the most common reason for silence.

2. Scope

In scope:

• convira.ai, app.convira.ai, api.convira.ai, and any other production subdomain we operate.
• The Convira desktop application (the macOS, Windows, and Linux builds we publish).
• The packages we publish under the Convira name.
• The agent runtime, tool registry, sandbox enforcer, and policy engine.

Out of scope:

• Findings against forks, third-party hosts, or self-built variants of the desktop app.
• Social engineering, physical attacks, or attacks against our employees outside of in-product channels.
• Rate limits, brute-force-only findings without a credential-validation impact, or volumetric denial of service.
• Reports generated solely by automated scanners without an exploit narrative.
• Missing security headers on marketing pages where the page has no sensitive surface.
• Vulnerabilities in third-party services we use. Report those directly to the vendor; our subprocessors page lists them.

3. Our commitments

When you report in good faith and under this policy:

• We acknowledge receipt within 2 business days.
• We give a triage decision (accepted, duplicate, out of scope, needs more info) within 5 business days.
• For accepted issues we share a fix timeline. Critical and High severity issues get a fix or mitigation in flight within 30 days; lower severity within 90 days.
• We will not pursue legal action against researchers who follow this policy in good faith.
• With your permission, we credit you in the acknowledgments below once the fix ships.

We do not run a paid bug-bounty program today. If that changes, this page will say so first.

4. Severity guidance

We classify reports using a CVSS-style rubric:

5. Safe harbor

The following are explicitly permitted while researching under this policy, as long as you stay within scope and stop the moment you have proof of impact:

• Creating test accounts and inviting test workspaces.
• Using your own paid subscription to exercise paid surfaces.
• Decompiling or running the published desktop binaries on hardware you own.

Not permitted:

• Accessing or exfiltrating data belonging to anyone other than yourself or accounts you control.
• Modifying or destroying data.
• Running automated traffic that degrades availability for other users. Load testing requires our written permission.
• Persisting access past the point needed to demonstrate impact.

6. Coordinated disclosure

We prefer coordinated disclosure. Please give us 90 days from acknowledgment to ship a fix before public disclosure. For severe issues we may ask for an extension, and we will keep you updated either way.

7. Acknowledgments

Researchers who report valid issues are credited here once the fix is live, unless they request anonymity. No reports have qualified yet; the first name on this list will have earned it.

Thank you for helping keep Convira and the people who rely on it safe. For how the product protects data day to day, see the Security page.