Vulnerability Disclosure Policy

Reporting a security issue

• Email: security@besavvier.com
• What to include: a description of the issue, the affected URL / API endpoint / component, steps to reproduce (proof-of-concept where possible), and the potential impact. Please do not include third-party personal data in your report.
• Preferred language: English.

We aim to acknowledge your report within 3 business days and to provide a substantive response — including our assessment and expected remediation timeline — within 10 business days. We'll keep you informed as we work toward a fix and let you know when it's resolved.

Safe harbor

We will not pursue or support legal action against researchers who, in good faith, discover and report vulnerabilities in accordance with this policy. We consider security research and disclosure conducted under this policy to be authorized, and we will work with you to understand and resolve the issue quickly. If in doubt about whether an action is authorized, ask us first at security@besavvier.com before proceeding.

Guidelines — please do

• Report any vulnerability you discover promptly.
• Make a good-faith effort to avoid privacy violations, data destruction, and interruption or degradation of our services.
• Only interact with accounts you own or have explicit permission to test.
• Give us a reasonable amount of time to remediate before any public disclosure, and coordinate disclosure timing with us.

Out of scope — please do not

• Access, modify, or delete data that does not belong to you; use test accounts and stop at proof-of-concept.
• Run denial-of-service, volumetric, or load/stress tests against our infrastructure.
• Use social engineering, phishing, or physical attacks against Savvier staff, users, or facilities.

Reports of the following, without a demonstrated security impact, are generally out of scope: missing security headers, TLS configuration on non-authenticated endpoints, rate-limiting on non-sensitive endpoints, clickjacking on pages with no sensitive actions, and automated-scanner output.

What to expect

• Acknowledgement of your report within 3 business days.
• An assessment and remediation timeline within 10 business days.
• Progress updates through resolution.
• With your permission, credit in our acknowledgements once the issue is fixed (we do not currently operate a paid bug-bounty program).

Machine-readable contact: /.well-known/security.txt. We appreciate your help in keeping Savvier and our customers safe.