Legal
Security Policy
Production trust surfaces should read like part of the platform: clear ownership, clear contacts, and a calm documentation standard.
Owner
CVERiskPilot LLC
Effective
March 30, 2026
Location
San Antonio, Texas
Responsible Disclosure
We take the security of CVERiskPilot and our customers' data seriously. If you believe you have found a security vulnerability in our platform, we encourage you to report it responsibly.
How to Report a Vulnerability
Send your report to security@cveriskpilot.com. Please include:
- A description of the vulnerability and its potential impact
- Step-by-step instructions to reproduce the issue
- Any supporting evidence (screenshots, HTTP requests, proof-of-concept code)
- Your preferred attribution name if you would like public credit
Our Commitment
- Acknowledgment within 24 hours — We will confirm receipt of your report
- Assessment within 5 business days — We will evaluate the report and provide an initial assessment
- Remediation timeline — Critical issues within 72 hours, high-severity within 14 days
- Credit — With your permission, we will publicly acknowledge your contribution
- No legal action — We will not pursue legal action against researchers who act in good faith
In Scope
- cveriskpilot.com and all subdomains
- The
@cveriskpilot/scannpm package - Authentication and authorization flaws
- Data exposure or cross-tenant leakage
- Injection vulnerabilities (SQLi, XSS, SSRF, etc.)
- API security issues
Out of Scope
- Denial of service (DoS/DDoS) attacks
- Social engineering or phishing of employees or customers
- Physical attacks against infrastructure
- Automated scanning without prior coordination
- Issues in third-party services (Stripe, Google, GitHub)
Our Security Practices
- AES-256-GCM encryption for secrets and integration credentials, on top of Google Cloud encryption at rest
- HTTPS only with HSTS (two-year max-age); TLS 1.3 with modern clients
- Multi-factor authentication (TOTP), with an option to require it for all signed-in members
- Role-based access control (11 roles, least privilege)
- Rate limiting on sign-in and public routes; a Cloud Armor web application firewall is planned
- Private VPC networking (no public database access)
- Tamper-evident audit logging with hash chains
- Hosted on Google Cloud, which holds SOC 2 Type II reports and ISO 27001 certification (CVERiskPilot's own SOC 2 audit has not started)
- 90-day log retention for forensic analysis
Compliance
The product maps findings to controls in up to 13 frameworks, including NIST 800-53, CMMC 2.0 Level 2, SOC 2, FedRAMP Moderate, ASVS and SSDF. Our own SOC 2 audit has not started; see /security.