Vulnerability Disclosure Policy

1. Reporting a concern

We welcome reports of potential security vulnerabilities affecting Nurvia. Email support@nurvia.app with the subject “Security report” and a concise description of the issue. We will provide an appropriate channel where sensitive supporting information is required.

2. Research authorization

Current authorized testing scope and any applicable research conditions are available on request. Obtain written authorization before active testing that could affect Nurvia’s systems, users, or data. This policy does not grant permission to test independently operated third-party services.

3. Testing restrictions

Do not conduct denial-of-service tests, phishing, social engineering, physical attacks, credential stuffing, destructive changes, malware deployment, or persistent access. Do not modify, export, retain, or publish another person’s private information.

4. Report details and coordination

Include the affected feature, a description of potential impact, minimal reproduction steps, relevant timestamps, and test account information. Use synthetic or appropriately redacted examples wherever possible.

5. Good-faith research

Nurvia will not pursue legal action solely for good-faith research conducted within a written authorization and its applicable conditions. This commitment does not bind third parties or authorize unlawful conduct. A report does not create an entitlement to payment unless a separate reward program expressly applies.

Related

• Legal Nurvia’s agreements and policies: terms, privacy, data processing, security, retention, cookies, messaging, acceptable use, and vulnerability disclosure.
• Terms of Service The terms governing Nurvia, Nuri, Autoflow, accounts, subscriptions, and authorized actions.
• Privacy Policy How Nurvia collects, uses, protects, and shares personal information, and the choices available to you.
• Cookie Notice How cookies and similar technologies are used, and how to manage your choices.
• Acceptable Use Policy Requirements for lawful, authorized, and responsible use of the Services.
• Trust & Security Privacy, security, and AI data handling at Nurvia: no model training on your content, permission-based actions, and clear retention.