Report security issues safely.

Email security@revory.app with a concise description, affected URL or component, reproduction steps and impact. Use test data and remove secrets. We will acknowledge and triage in a commercially reasonable manner but do not promise a fixed response or bounty.

REVORY-owned application and API authorization, workspace isolation, authentication, import handling, exports, billing-event handling and accidental disclosure of REVORY-managed data.

Social engineering, phishing, denial of service, credential stuffing, spam, physical attacks, testing third-party infrastructure outside REVORY’s control, automated high-volume scanning, and issues requiring access to another person’s data.

If you act in good faith, avoid privacy harm and disruption, test only accounts/data you control, stop when sensitive data appears, do not extort or publicly disclose before remediation, and follow this policy, we will not pursue action merely for that compliant research. This does not authorize violation of law or third-party rights.