Report security concerns responsibly.

1. Report a suspected vulnerability

Email support@civerent.com with the subject line Security Report. Include the affected URL or feature, a clear description, the date and time observed, potential impact, and minimal reproduction steps.

Do not send passwords, authentication tokens, private keys, complete payment-card information, unnecessary personal information, or executable exploit code through ordinary email. Civerent may arrange a safer transfer method after reviewing the initial report.

2. Good-faith reporting expectations

• Use only accounts and information you own or are expressly authorized to test.
• Stop testing and report promptly if you encounter information that does not belong to you.
• Use the minimum interaction necessary to demonstrate the suspected issue.
• Avoid privacy violations, service interruption, data alteration, and degradation of another user's experience.
• Allow Civerent reasonable time to investigate and address a validated issue before public disclosure.

3. Prohibited activity

• Denial-of-service, load, stress, or resource-exhaustion testing.
• Destructive testing, data deletion, persistence, malware, ransomware, or command-and-control activity.
• Social engineering, phishing, credential theft, physical attacks, or attacks against employees, contractors, customers, or providers.
• Automated scanning that creates material traffic, triggers account lockouts, or violates provider terms.
• Accessing, downloading, modifying, retaining, or disclosing information belonging to another person or organization.
• Testing third-party infrastructure unless that provider has separately authorized the activity.

4. Authorization boundary

This disclosure page is a reporting channel, not blanket authorization to test Civerent or its providers. Researchers should request written authorization before conducting activity beyond ordinary product use and minimal, non-destructive validation.

Civerent intends to evaluate good-faith reports constructively. Legal protections, safe-harbor language, reward eligibility, disclosure timing, and testing scope are not promised unless confirmed in writing for a specific engagement.

5. What to expect

Civerent will review the report, attempt to validate the issue, assess impact, and determine remediation and communication steps. Response timing depends on severity, reproducibility, affected systems, and available operating capacity.

Civerent does not currently publish a bug-bounty program or guarantee payment. Do not incur costs or expect compensation without a prior written agreement.