Security
Responsible disclosure
Found a security issue in PV0T? Thank you for looking. Here’s how to tell us, and what you can expect.
How to report
Email contact@pv0t.com with the subject “Security report”. Please include:
- What you found and where (the page, address, or part of the app)
- Steps to reproduce it, and any proof of concept
- The impact you think it has
- How we can reach you for follow-up questions
Please don’t share the details publicly or with anyone else until we’ve fixed it.
What you can expect from us
- We confirm we received your report within 3 business days.
- We tell you whether we could reproduce it, and our plan, within 10 business days.
- We keep you updated until it’s fixed, and let you know when it is.
- With your permission, we credit you by name once it’s fixed.
We don’t currently run a paid bug bounty program.
In scope
- pv0t.com and www.pv0t.com (the website and the app)
- auth.pv0t.com (PV0T’s sign-in and data API)
- downloads.pv0t.com (desktop app downloads and updates)
- The PV0T desktop app and the PV0T browser extension
Out of scope
- Services run by other companies that PV0T uses (for example Supabase, Vercel, Google, or Polar): please report those to them
- Denial-of-service or load testing, and high-volume automated scanning
- Social engineering, phishing, or physical attacks against anyone at PV0T
- Reports from automated scanners without a working proof of impact
- Missing security headers or best practices without a demonstrated security impact
- Self-XSS, and clickjacking on pages with no sensitive action
- Issues that only affect outdated or unsupported browsers
Rules and safe harbor
To keep research safe for our users, please:
- Test only with accounts you own or have permission to use
- Never access, change, or delete other people’s data. If you reach someone else’s data by accident, stop, don’t keep a copy, and tell us
- Do only what’s needed to show the issue exists
- Give us reasonable time to fix it before any public disclosure (we aim for 90 days at most)
If you follow these rules in good faith, we consider your research authorized, we won’t pursue or support legal action against you for it, and we’ll work with you to understand and fix the issue.