Security disclosure

1. Reporting

Security contact for Clavis is [email protected].

When reporting a potential vulnerability, include affected components, reproduction steps, and expected impact.

2. Responsible testing

Please avoid actions that may affect other users, live service data, or service availability.

Use non-destructive testing methods wherever possible.

3. Handling process

Our standard flow is to acknowledge receipt, assess impact and severity, prioritise mitigation or fixes, and coordinate disclosure where appropriate.

We aim to acknowledge receipt within five business days. We do not promise a date for a fix. There is no bounty.

4. Tests that follow this policy

Where a report and test follow the responsible-testing section, we will not bring a civil claim about that test.

We cannot, and do not, undertake that a criminal case will not be opened.

Tests that affect other users, live service data, or service availability fall outside this position.