Found something? Safe harbour, in writing.
Trustvice is a compliance and trust platform — the bar we hold our customers to, we hold ourselves to. If you find a vulnerability, report it in good faith through security@trustvice.com and you are protected: a defined scope, a response SLA, and a coordinated 90-day window before public disclosure. This page is the human-readable companion to /.well-known/security.txt.
Safe harbour
Act in good faith, and we won't pursue you.
Security research conducted under this policy is authorised. We will not initiate or support legal action against you, and we consider your testing to be in good standing under applicable computer-misuse and anti-circumvention law, provided you:
- Access only data and accounts that are your own, or that you have explicit permission to test.
- Take no more data than is necessary to demonstrate the issue, and never store, share, or use customer data you encounter.
- Do not degrade service, exfiltrate data, or pivot to attack other customers.
- Give us a reasonable time (90 days) to remediate before public disclosure, and coordinate timing with us.
- Comply with all applicable law.
If legal action is brought against you by a third party for activity that complied with this policy, we will make it known that your actions were authorised.
How to report
One inbox. A human reads it.
A clear description of the issue and its security impact.
Step-by-step reproduction — request/response, URL, account/workspace context (use your own).
The affected asset (host, endpoint, or surface) and the time of testing (UTC).
Any proof-of-concept code or screenshots — kept to the minimum needed to demonstrate the issue.
Scope
What's in, what's out.
In scope
- www.trustvice.com and the marketing site
- app.trustvice.com — the customer dashboard
- api.trustvice.com — the gateway / agentic API surface
- ui.tve.world — the MCP Apps confirmation iframe origin (deliberately a separate registrable domain from trustvice.com, so no session cookie reaches it)
- The /.well-known/* discovery + cryptographic-key endpoints
- Authentication (WebAuthn / FIDO2, magic links) and session handling
Out of scope
- Findings against our sub-processors (Cloudflare, Amazon Web Services, Stripe, fraud providers) — report those to the provider; tell us if a Trustvice misconfiguration is the cause.
- Volumetric / denial-of-service, brute force, or load testing.
- Social engineering of staff or customers, and physical attacks.
- Best-practice reports with no demonstrated impact (e.g. a missing header, SPF/DMARC nits, version disclosure) absent a concrete exploit.
- Spam, self-XSS, or issues requiring a fully compromised victim device.
What you can expect from us
A timeline, not a void.
Acknowledge within 2 business days
We confirm receipt of your report and assign it a tracking reference. A human reads every report sent to security@trustvice.com.
Triage + severity within 5 business days
We validate, assign a severity, and tell you our remediation plan. We mirror the dispute-SLA discipline already published on /security: critical 24 h · high 3 d · medium 7 d · low/info 14 d for first substantive response.
Coordinated 90-day window
We ask for up to 90 days to remediate before public disclosure, and we keep you informed of progress. If a fix needs longer, we agree an extension with you rather than going dark.
Credit, if you want it
With your permission we credit you by name or handle once a fix ships. Trustvice is pre-revenue and does not currently run a paid bounty — this is a safe-harbour and recognition program, stated plainly.
Machine-readable + further reading
Trustvice 360Declare the rules. Have every run checked.
Agents, evidence, governance, commerce and disclosure are all in Trustvice 360. Sign up free and open every suite from one dashboard.
