Security
Report a vulnerability.
Write to security@ravenflo.io. We would rather hear it from you than read it in public.
What to send.
A description, the version you tested, the steps to reproduce, and the impact as you see it. A proof that stays inside systems you are allowed to test is enough. Please do not include data that belongs to someone else.
In scope.
The RavenFlo apps, the server software, this website, and the cryptographic design described in the whitepaper. If you are unsure, ask before you test a customer.
Out of scope.
- Social engineering of our people or of a customer’s people.
- Physical access to a customer’s data centre.
- Denial of service, and tests that degrade a live service.
- Findings that live only in a third-party product we did not write.
- Missing headers or best-practice notes with no demonstrated impact.
What we will do.
We will acknowledge a report within 3 business days. We will keep you informed while we fix it. We ask for 90 days before public disclosure, and we will not ask you to stay silent about a problem we refuse to repair.
Good faith.
If you follow this policy, act in good faith, and avoid privacy violations, destruction of data and interruption of service, RavenFlo will not pursue legal action against you for the research. This is a statement of intent. It is not a waiver of a customer’s rights in their own systems.
The machine-readable file is at /.well-known/security.txt.