Norveth

Responsible Disclosure

Last updated: July 23, 2026

Norveth is an independently operated platform. If you find a security issue, we'd genuinely rather hear it from you first.

Safe harbor

We won't pursue legal action against security researchers who discover and report vulnerabilities in good faith, in accordance with this policy. Testing conducted consistent with this policy is authorized.

1. Reporting a vulnerability

Email security@norveth.app with what you found and how to reproduce it.

  • Include target URLs, request/response detail, and a proof of concept where possible.
  • Don't run anything that could degrade the platform for other users — no DoS, no spam, no destructive testing against real account data.
  • Give us reasonable time to investigate and fix the issue before any public disclosure.

2. In-scope targets

  • norveth.app and its subdomains
  • The Norveth REST API (norveth.app/api)
  • Authentication and authorization flows

3. Out of scope

  • Clickjacking on pages with no sensitive action.
  • Self-XSS.
  • Missing security headers with no demonstrated, direct impact.
  • Denial of service / availability attacks.
  • Social engineering or phishing against Norveth's operator or users.

4. What to expect

Norveth is currently a solo-operated project — you'll get a personal reply, not a ticketing queue, but that also means response times aren't governed by a formal SLA. Genuine, responsibly disclosed reports are prioritized and acknowledged as quickly as possible, and we're glad to credit you publicly once it's fixed, if you'd like. There's no paid bug bounty program today.