Security disclosure

Report a vulnerability

Email security@falconveritas.com with a concise description, affected FVI-managed asset or route, impact, safe reproduction steps, and a contact method. Please redact customer or personal data, credentials, keys, and tokens. If sensitive evidence needs a secure exchange, ask before sending it.

No fixed acknowledgment, triage, remediation or publication-response SLA is stated here. The team should coordinate next steps with the reporter; timelines depend on validation, impact and remediation work.

Good-faith testing and safe harbor

The existing public Security page invites private reports and states that FVI does not pursue legal action for good-faith testing that respects user privacy, data integrity and service availability. This preview carries that statement forward for review; counsel and the security owner must reconfirm its scope and authority before publication.

Limit testing to assets operated by FVI, avoid accessing or changing another person's data, and stop if a test could affect availability. Do not conduct denial-of-service testing, social engineering, physical testing, or testing against a third-party provider without its authorization. These scope boundaries require security-owner approval.

Reportable issue classes

The following are examples for private triage, not a guarantee that a report is in scope or eligible for a reward.

• Authentication, authorization or account-control flaws.
• Cross-tenant access, unintended disclosure or integrity changes.
• Injection, cross-site scripting, request forgery or server-side request abuse.
• Exposed secrets, cryptographic weaknesses, unsafe configuration or vulnerable dependencies.
• Other reproducible weaknesses with a credible confidentiality, integrity or availability impact.

Encryption, disclosure timing and recognition

No PGP key is published by this preview. Do not send secrets or unredacted customer data by ordinary email; ask the security contact whether a secure channel is available.

This page does not establish a fixed disclosure window, remediation deadline, bounty or acknowledgment list. The existing security.txt contains a coordinated-disclosure interval that must be reviewed together with the corrected security.txt file before publication.