# Corvalon HRM Vulnerability Disclosure Policy

Last updated: 2026-06-12

Corvalon welcomes and encourages responsible security research. If you believe you have found a security vulnerability in the Corvalon HRM Platform, we ask that you disclose it responsibly by following this policy.

---

## Scope

### In Scope

- Corvalon HRM Platform web application (*.corvalonhrm.com)
- REST API endpoints (`/api/v1/*`)
- Authentication and session management
- Tenant isolation mechanisms
- Data encryption (at rest and in transit)
- RBAC and permission boundaries

### Out of Scope

- Third-party services and integrations
- Social engineering attacks against Corvalon employees or customers
- Physical security of infrastructure
- Denial-of-service (DoS/DDoS) attacks
- Automated scanning without prior coordination
- Testing against production customer environments
- Attacks requiring physical access to a user's device
- Clickjacking on pages with no sensitive actions

---

## Rules of Engagement

To qualify for safe harbor protections, researchers must:

1. **Act in good faith** to avoid privacy violations, data destruction, and service disruption
2. **Only interact with accounts you own** or accounts for which you have explicit written permission from the account holder
3. **Do not exploit vulnerabilities** beyond what is necessary to demonstrate the issue (proof of concept only)
4. **Do not exfiltrate** customer data under any circumstances
5. **Report vulnerabilities promptly** and do not disclose publicly before coordinated disclosure
6. **Do not use automated tools** against production systems without prior written authorization

---

## Reporting Process

### How to Report

**Email:** security@corvalonhrm.com

**PGP Key:** Available at `/.well-known/pgp-key.txt` (when published)

### What to Include

Please provide the following in your report:

- **Description** of the vulnerability
- **Steps to reproduce** (detailed proof of concept)
- **Affected component(s)** and version(s) if known
- **Impact assessment** (what an attacker could achieve)
- **Screenshots or video** if applicable
- **Suggested remediation** (optional but appreciated)

### What NOT to Include

- Do not include actual customer data in your report
- Do not include credentials or access tokens (redact them)

---

## Response Timeline

| Step | Timeline |
|------|----------|
| Acknowledgement of your report | Within 24 hours |
| Initial triage and severity assessment | Within 48 hours |
| Status update with remediation plan | Within 7 days |
| Vulnerability fix deployed | Per severity SLA (see below) |
| Public disclosure (coordinated) | After fix is verified and deployed |

### Remediation SLAs

| Severity | CVSS Score | Remediation Deadline |
|----------|-----------|---------------------|
| Critical | 9.0 to 10.0 | 24 hours |
| High | 7.0 to 8.9 | 7 days |
| Medium | 4.0 to 6.9 | 30 days |
| Low | 0.1 to 3.9 | 90 days |

---

## Safe Harbor

Corvalon will not pursue legal action against security researchers who:

- Make a good faith effort to comply with this policy
- Avoid privacy violations, data destruction, and service disruption
- Only interact with accounts they own or have explicit permission to test
- Report vulnerabilities promptly and avoid public disclosure before coordination
- Do not exploit vulnerabilities for personal gain beyond the scope of the report

We consider security research conducted in accordance with this policy to be:

- **Authorized** under the Computer Fraud and Abuse Act (CFAA)
- **Exempt** from DMCA claims related to circumvention of security controls
- **Lawful** and conducted in good faith

If legal action is initiated by a third party against a researcher who acted in accordance with this policy, Corvalon will make reasonable efforts to clarify that the researcher's actions were authorized.

---

## Recognition

We believe in recognizing the contributions of security researchers:

- Researchers who report valid vulnerabilities will be credited (with permission) in our security acknowledgments
- A formal bug bounty program is planned and details will be published when available
- We are happy to provide a reference letter confirming your responsible disclosure

---

## Security Testing Schedule

Corvalon conducts regular security testing independently:

| Test Type | Frequency | Provider |
|-----------|-----------|----------|
| External penetration test | Planned pre-launch (none performed yet); annual thereafter | Third-party vendor |
| Internal penetration test | Semi-annual (begins post-launch) | Internal security team |
| Dynamic application security testing (DAST) | Every PR + quarterly full scan | ZAP |
| Static application security testing (SAST) | Every PR + weekly | Semgrep |
| Go vulnerability scanning | Every PR + weekly | govulncheck |
| Container image scanning | Every PR + weekly | Trivy |
| Dependency vulnerability scanning | Daily | Dependabot |

---

## Contact

- **Security reports:** security@corvalonhrm.com
- **General inquiries:** support@corvalonhrm.com
- **Trust Center:** [https://corvalonhrm.com/trust](https://corvalonhrm.com/trust)