Security Policy
Covenantory takes security reports seriously. This policy explains how to contact us and what information helps us investigate safely.
Contents
1. Report a security issue
Email security@covenantory.com to report a vulnerability or suspected security issue.
Reports are monitored during business hours. Acknowledgment and triage timing depend on the nature of the report.
2. What to include
Include the following when available:
- A clear description of the issue.
- Steps to reproduce, if available.
- The affected URL, endpoint, account role, or workflow.
- The potential impact.
- Screenshots, logs, or proof-of-concept details that are safe to share.
3. Protect sensitive information
Do not include sensitive personal, financial, or tenant data unless it is necessary to explain the issue. Share only the minimum information needed for us to understand and reproduce the concern.
4. What happens next
Covenantory reviews reports, triages severity, and coordinates remediation based on risk and impact. Timing depends on the nature and complexity of the report.
5. Machine-readable contact
Our machine-readable security contact is published at https://covenantory.com/.well-known/security.txt.