Policy
Responsible disclosure
If you have found a security issue in our systems, we want to hear from you, and we will not take legal action against you for telling us.
Scope
This policy covers systems Prava operates: the prava.dev website and the Prava platform and its APIs.
It does not cover our customers’ systems. If you have found something in an environment we test, report it to that organisation — we cannot authorise testing of anything that is not ours.
How to report
Email security@prava.dev. A person reads that address. Include enough for us to reproduce the issue:
- What you found, and what an attacker could do with it.
- The steps to reproduce it, including any request or payload.
- The affected host or endpoint, and roughly when you tested.
- How you would like to be credited, if you would like to be.
What we ask
- Give us a reasonable chance to fix it before you publish.
- Use only the access needed to demonstrate the issue. Do not read, change or keep anyone else’s data.
- Do not degrade the service. No denial of service, no bulk automated scanning, no social engineering of our staff or our customers.
- Stay out of scope. If you find yourself in a customer environment, stop.
What you can expect
- An acknowledgement that a human has read your report, not an autoresponder.
- An assessment of whether we agree it is an issue, and our reasoning either way.
- Progress updates while we fix it, and word when it is closed.
- Credit where you want it.
Needs confirming — the response and remediation windows we are willing to commit to in writing, and whether a reward is offered. Until those are agreed this page promises effort, not deadlines.
Safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as authorised, we will not pursue legal action, and we will say so to anyone who asks. If you are unsure whether something is in scope, ask first.