Draft — under review. We welcome reports from security researchers and treat the security of our customers' data as a priority.
1. Reporting a vulnerability
Email security@rezva.online with a clear description, the affected URL or endpoint, the steps to reproduce, and the potential impact. This contact is also published in our security.txt.
2. Scope
In scope: the Rezva service and the systems we operate under rezva.online and its subdomains. Out of scope: our tenants' own external websites and systems, third-party services we rely on, volumetric denial-of-service, social engineering of our staff or customers, physical attacks, and automated scanner output without a demonstrated proof of concept.
3. Safe harbour
We will not pursue legal action for good-faith security research that respects this policy: stay within scope, do not access, modify, or destroy data that is not yours, do not degrade the service for others, and give us a reasonable opportunity to remediate before any public disclosure.
4. What to expect
We aim to acknowledge your report within a few business days, keep you informed as we investigate, and coordinate timing on any public disclosure. We do not currently run a paid bug-bounty programme, but we are grateful for responsible reports and are happy to credit you where appropriate.
5. Please do not
Access or exfiltrate other people's personal data, run automated scans that degrade the service, or publicly disclose a vulnerability before we have had a reasonable chance to fix it.