Report a security vulnerability

What to include

• The affected product, URL, or app version.
• A description of the issue and what an attacker could do with it.
• Steps to reproduce it, using a test account and sample data where possible.
• Redacted screenshots or a minimal proof of concept, if available.
• When you found the issue and whether it may already be exploited.

You can report a suspected vulnerability even if you cannot reproduce it fully.

Protect people and their data

This policy covers reports about products and services operated by Alcova. It does not grant permission to test third-party services, including connected CRM, email, or cloud providers. If you're unsure whether a system is operated by us or whether a test is permitted, contact us before testing.

• Use only accounts and data you own or have explicit permission to test.
• Limit testing to what is needed to demonstrate the issue. Do not disrupt services, change or delete other people's data, or establish persistent access.
• Do not use social engineering, phishing, physical intrusion, or denial-of-service testing.
• If you encounter client data, credentials, or other sensitive information, stop testing and report it immediately. Do not download, retain, or share that information.

Testing instructions

• Keep automated testing below ten requests per second in total across Alcova services. This is a ceiling, not permission to disrupt a service. Stop immediately if testing causes errors, slow responses, or other disruption.
• Where your tools allow it, add an X-Security-Researcher request header containing a researcher alias, and include that alias in your report so we can identify your traffic.
• Test access controls using accounts and test records you control. Do not access another customer's account or records to prove an issue.
• For command execution, use a harmless command such as whoami or hostname. Do not install software, open a remote shell, or establish persistence.
• For file access or injection findings, use a harmless test file or synthetic record you created. Do not enumerate or extract production files, credentials, or database records.
• If a finding cannot be demonstrated within these limits, send the evidence you have and contact us before attempting further testing.

Report eligibility

An eligible report identifies a previously unknown vulnerability in an Alcova-operated product or service, explains its security impact, and gives us enough evidence to validate it. Follow this policy and report the issue privately before publishing it.

We prioritise findings that could expose customer information, bypass authentication or authorisation, cross an organisation boundary, or allow unauthorised actions or code execution.

The following are not eligible for public recognition unless they demonstrate a security impact:

• Automated scanner output or a vulnerable dependency version without evidence that Alcova is affected.
• Missing security headers or cookie flags, version banners, or verbose errors without sensitive information.
• Self-XSS, clickjacking, open redirects, or cross-origin configuration findings without a realistic attack against another user.
• Missing rate limits, email authentication configuration, or other hardening suggestions without an exploitable weakness.

Multiple reports with the same underlying cause count as one vulnerability. Only the first eligible report of an issue that was not already known to us qualifies for recognition. Findings in third-party systems are outside this programme.

If you're unsure whether a finding qualifies, you can still report it. Eligibility for recognition does not limit the safe harbour below.

After you report

We will acknowledge your report within five business days.

We review reports to understand the affected systems, potential impact, and steps needed to address the issue. We may ask you for more information to reproduce it.

Please coordinate any public disclosure with us and give us a reasonable opportunity to investigate and address the issue. Avoid publishing exploit details or information that could expose customers while that work is under way.

Safe harbour for good-faith research

For good-faith security research that follows this policy, Alcova will neither take legal action against you nor ask law enforcement to investigate you. Share the full details of the issue with us and make every effort to protect privacy, preserve data, and avoid interrupting or degrading our services.

This commitment applies to Alcova and cannot bind third parties or authorise testing of their systems.

Public recognition

We do not offer monetary bounties, payments, or other rewards. Our only reward is public recognition for eligible reports of confirmed vulnerabilities.

After remediation, we will publish a summary of the vulnerability and credit the first eligible reporter by their chosen name or alias, with their consent. You can choose to remain anonymous. We will coordinate the publication timing and content with you and exclude customer information and details that could put users at risk.

Published acknowledgements

No vulnerability disclosures have been published on this page yet.