Report privately. Email jmarshall@qvert.net with a subject beginning SECURITY:. Do not disclose an uncorrected vulnerability publicly or include credentials, private keys, unrelated customer data, or destructive proof-of-concept activity.
1. Security principles
Qvert LLC designs Qvert products around explicit authorization, least privilege, visible scope, local processing where practical, secure transport for connected features, and separation between customer environments. Security controls vary by product, deployment, and maturity, and no software can guarantee absolute security.
2. What to include
- affected product, version, URL, extension identifier, or package;
- vulnerability type and practical impact;
- reproduction steps using the minimum access and data necessary;
- sanitized screenshots, requests, responses, logs, or proof of concept;
- whether the issue is actively exploited or exposes customer information; and
- your preferred name and contact method for coordination.
3. Research expectations
Use good-faith testing against systems and accounts you own or are explicitly authorized to test. Stop when you have enough evidence to demonstrate the issue. Avoid accessing, changing, retaining, or transmitting another person’s data; disrupting availability; degrading service; creating persistence; moving laterally; or using social engineering, phishing, physical intrusion, denial of service, spam, or credential stuffing.
4. Out of scope
Reports limited to missing non-security headers without demonstrated impact, clickjacking on pages with no sensitive action, self-XSS, rate limits with no practical security consequence, unsupported software versions, third-party systems outside Qvert control, automated scanner output without validation, social engineering, denial of service, or issues requiring a compromised device are ordinarily out of scope.
5. Coordinated disclosure
Allow reasonable time for validation, remediation, release, and customer protection before public disclosure. Qvert will make reasonable efforts to acknowledge a credible report, keep the reporter informed at material milestones, and credit the reporter if requested and appropriate. Response time depends on severity, product maturity, reproducibility, and operational impact.
6. Safe harbor
When research is conducted in good faith, within this policy, and without violating another party’s rights, Qvert will not initiate legal action solely because of that research. This statement does not authorize testing of third-party systems, customer environments, or infrastructure Qvert does not own, and it does not waive rights concerning extortion, privacy violations, data theft, service disruption, or conduct outside this policy.
7. No bounty commitment
Qvert does not currently operate a standing paid bug-bounty program. Submission of a report does not create a right to payment, reward, employment, or reimbursement. Any recognition or reward is voluntary and must be confirmed in writing.
8. Security incidents and support
Customers reporting suspected compromise of their own account or environment should also follow their incident-response process, rotate exposed credentials, preserve evidence, and contact the relevant identity, cloud, browser, or storefront provider. General product problems should use the Support page.