Responsible Disclosure
We take security seriously and value the work of researchers who help us keep our platform and customers safe. If you have found a vulnerability, we want to hear from you.
Our Policy
Security research helps us build a more resilient platform. These guidelines define how we work with researchers.
Two hosts only: alvor.io (this website) and demo.alvor.io (our demo instance). Every other alvor.io subdomain is out of scope and must not be tested.
We acknowledge all reports within 24 hours and aim to provide an initial assessment within 5 business days.
We will not pursue legal action against researchers who act in good faith and follow this policy.
We ask that you do not publicly disclose the vulnerability until we have had reasonable time to address it.
With your permission, we will credit you publicly for verified vulnerabilities in our security advisories.
Submit a Report