Reporting a security issue in Provaex

Provaex tests other people's systems for a living, which means

our own platform gets held to at least the same standard. If you've

found a vulnerability in provaex.com, the dashboard, the

verification flow, or the test-execution API, we want to know before

anyone else does.

Scope

In scope: provaex.com, api.provaex.com, the endpoint-verification

flow, and the test-execution worker.

Out of scope: third-party services we depend on (Stripe, Supabase,

Vercel) — please report those directly to the provider.

How to report

Email security@provaex.com with a description of the issue,

steps to reproduce, and (if applicable) the affected endpoint or

account — using a test account of your own, not a live client's.

Please don't:

• Access, modify, or exfiltrate another user's data, including

another client's stored test results or endpoint credentials

• Test against a client's verified endpoint yourself — test against

our platform's own infrastructure, or a target you separately own

and control

• Publicly disclose an issue before we've confirmed a fix or 90 days

have passed, whichever is sooner

What to expect

• Acknowledgment within 2 business days
• A fix timeline once we've confirmed the report
• Credit in our changelog, if you'd like it

This isn't a paid bug bounty program today. If that changes, this page

will say so.