Responsible Disclosure Policy & Bug Bounty

Effective August 10, 2026 — this page is the researcher-facing summary of Improvado's Responsible Disclosure Policy (RDP-001, version 1.6) and describes how to report vulnerabilities in Improvado's products and infrastructure, what you can expect from us, and the protections we extend to good-faith security research.

How to Submit a Vulnerability

Report vulnerabilities to Improvado's security team by email at security@improvado.io (preferred channel). Our machine-readable reporting contact is also published at /.well-known/security.txt (RFC 9116). Researchers who wish to encrypt their submission may request our PGP key via the same email.

What to include in a report:

• A clear, English-language description of the vulnerability.
• The affected asset, URL, or component.
• Steps to reproduce, including proof-of-concept code or screenshots where helpful.
• Impact assessment — what the vulnerability could enable an attacker to do.
• Suggested remediation, if available.
• Any plans or intentions for public disclosure, including timing.
• Your contact information.

Scope

In scope:

• The Improvado customer-facing platform at the publicly published Improvado domains.
• Improvado customer-facing APIs at the publicly published API endpoints.
• Improvado-owned and -operated public domains and subdomains that host Improvado services.

Out of scope (not covered by Safe Harbor):

• Customer data in any form, including customer-controlled credentials.
• Third-party services integrated with Improvado — report vulnerabilities in those services to the relevant vendor.
• Customer-controlled tenants or destinations accessed via Improvado.
• Social engineering, phishing, vishing, or smishing against Improvado's workforce, contractors, or vendors.
• Denial-of-service (DoS/DDoS) testing and large-scale rate-limit-bypass testing.
• Spam or automated mass-account creation.
• Physical-security testing and vulnerabilities requiring physical access to a device.
• Purely theoretical findings with no demonstrable impact.
• Reports of outdated software versions without a demonstrated exploit.
• Best-practice or hardening recommendations with no associated vulnerability (for example, missing security headers without an exploit).

Rules of Engagement

Authorized testing includes black-box testing of public endpoints, authentication and authorization testing using accounts you legitimately control, testing aligned with the OWASP Top 10 and OWASP API Security Top 10, and reasonable, low-volume API testing consistent with normal usage.

You must not:

• Access, modify, exfiltrate, retain, or share Improvado data, customer data, or other users' data beyond the minimum needed to demonstrate the vulnerability.
• Use automated scanners in a way that materially affects service availability.
• Attempt to phish or social-engineer Improvado workforce members.
• Move laterally beyond the initial finding to pivot into other systems.
• Disclose findings publicly before the agreed coordinated-disclosure timeline expires.

If you inadvertently encounter customer data or other sensitive third-party information, stop testing immediately, do not access or copy further data, securely delete any data already accessed, and note this in your report.

Safe Harbor

Improvado considers good-faith security research conducted within the scope and rules above to be authorized. For such research, Improvado will not pursue civil action under the U.S. Computer Fraud and Abuse Act (CFAA) or the Digital Millennium Copyright Act (DMCA), or under analogous laws in your jurisdiction, and will not initiate or support criminal complaints related to the research. Safe Harbor does not apply to activity outside the scope of this policy, to violations of the rules of engagement, or to harm caused to Improvado, its customers, or third parties. If you are unsure whether a planned test is in scope, ask us first at security@improvado.io.

What You Can Expect from Improvado

• Acknowledgement of your report within 2 business days.
• A triage outcome (validated / not applicable / duplicate / out of scope) within 10 business days for most reports.
• An expected remediation timeline following triage, aligned with our severity-based targets (Critical: 7 days; High: 30 days; Medium: 90 days; Low: best-effort with documented acceptance).
• Open dialogue throughout the lifecycle, including notification at each review stage.
• Credit in public communications following remediation, where you consent to it.

Coordinated Disclosure

The default coordinated-disclosure window is 90 calendar days from the date Improvado acknowledges the vulnerability. For critical vulnerabilities that require customer-facing changes or third-party coordination, we may request an extended window; a shorter or longer timeline can be mutually agreed. Where a vulnerability is being actively exploited, we prioritize remediation immediately and may publish advisories ahead of the standard window.

Bug Bounty

Improvado operates a bug-bounty program for valid, in-scope findings, and we pay real money for them.

Award amounts are decided case by case by our security team and approved by the CTO. The two things that matter most are the severity of the issue and its actual impact on Improvado — what the finding would let an attacker reach in our environment, rather than its severity in the abstract. We also weigh exploit complexity, blast radius, novelty, and how clearly the report is written. A well-written report that lets us reproduce the issue quickly is worth more to us than one we have to reverse-engineer.

Every valid report also receives public credit following remediation, where you consent to it, and we may offer Improvado merchandise as additional recognition.

When we do not pay an award

Two outcomes carry no bounty, and we will always tell you which one applies.

• Duplicate. Another researcher reported the same issue before you.
• Already known to us. We had already identified the issue ourselves — through a penetration test, an internal review, or our own engineering work — and it was being tracked before your report arrived.

In both cases we confirm that the earlier report or the existing work predates your submission. We do not share the internal ticket or its history. Neither outcome is a judgement on the quality of your work: it means the report did not tell us something we did not already know and were not already fixing.

Variants and bypasses are judged on their own merits

A finding is not a duplicate simply because it touches an area we already have work in progress on. If you can show a materially different exploitation path, a bypass of a fix we believed was complete, or an impact that our existing work does not cover, we treat it as a new finding and it is eligible for an award. If you think your finding is a variant rather than a duplicate, say so in your report and explain the difference — we would rather read that explanation than have you decide not to send it.

AI / LLM Findings

Reports relating to AI and LLM features of the Improvado platform — including prompt injection, output manipulation, jailbreaks, model-disclosure issues, and unsafe model behavior — are accepted under this policy and evaluated with the same severity framework.