Legal
Vulnerability Disclosure Policy
Effective Date: November 7, 2026 (Version 2026.4)
We welcome reports of security vulnerabilities in DVSentry. Write to security@dvsentry.com with the steps to reproduce and the impact you observed.
1. In scope
dvsentry.com and the subdomains DVSentry operates (including app.dvsentry.com), the DVSentry API, and the DVSentry agent, command-line client and IDE extension.
2. Out of scope
- Systems of DVSentry's customers. Never test them through DVSentry or otherwise without their owner's permission.
- Third-party services we use (Cloudflare, Google Cloud, GitHub, Cashfree, email and AI providers).
- Denial of service, load testing and spam.
- Social engineering of DVSentry staff, customers or users, and physical attacks.
- Automated scanner output without a demonstrated impact, and missing best-practice headers without an exploit.
3. Rules
Use only accounts and organizations you created. Do not access, change or delete other people's data; if you reach any, stop, do not keep it, and tell us. Do not degrade the service. Give us a reasonable time to fix the issue (we aim for 90 days) before you publish.
4. Our promise
We acknowledge your report within 3 business days, keep you updated, and credit you if you wish. If you make a good-faith effort to follow this policy, we will not take legal action against you, or ask anyone to, for your research on DVSentry's own systems, and we consider that research authorized by DVSentry. We cannot authorize testing of anyone else's systems.
5. Rewards
There is no paid bounty at present.