Responsible Disclosure Policy

#1. About this policy

#1.1 Purpose of this policy

We welcome reports from security researchers. This policy explains what you may test, how to report what you find and what you can expect from Coviola Group LLC (trading as Benvo), a Wyoming limited liability company (original filing ID 2026-001898597), 30 N Gould St, Sheridan, WY 82801, USA ("Benvo", "we", "us"), in return. It is published at https://benvo.io/legal/responsible-disclosure and is the policy referred to in our security.txt file at https://benvo.io/.well-known/security.txt.

#2. In scope

#2.1 Services in scope

These services are in scope. Test only with accounts you created yourself or credentials we gave you for testing.

(a) benvo.io and its subdomains, including the website, status.benvo.io, docs.benvo.io and venue pages we host (for venue pages, only Benvo's platform is in scope, not the venue's own systems or data);

(b) the client app at app.benvo.io, the members app and the booking and enquiry forms it serves;

(c) the Benvo Console at console.benvo.io (sign-in is limited to the Benvo team, so report what you can observe without an account);

(d) the POS at pos.benvo.io and the device pairing flow;

(e) the developer portal at developers.benvo.io and the public API at api.benvo.io, including API keys, webhooks and request signing; and

(f) the official Benvo software development kits we publish.

#3. Out of scope

#3.1 Out of scope issues

These are out of scope and not eligible for any reward. Report them only if you can show a real impact on the security of Benvo or its users.

(a) Reports from automated scanners without a working proof of impact.

(b) Missing security headers, cookie flags or email records such as SPF, DKIM and DMARC, without a demonstrated attack.

(c) Clickjacking on pages with no sensitive action, self cross-site scripting, and cross-site request forgery on sign-in or sign-out.

(d) Rate limits on endpoints that do not affect accounts, money or data.

(e) Denial of service, load or stress testing, and anything that degrades the service for others.

(f) Social engineering, phishing or physical attacks against our team, our clients, their guests or staff.

(g) Services run by third parties, such as payment, messaging or hosting providers. Report those to the provider.

(h) Websites on a venue's own domain that Benvo does not host, and accounts, data or devices that do not belong to you.

(i) Software version disclosure, content spoofing without HTML injection, and issues that only affect outdated browsers or rooted devices.

#4. Rules for testing

#4.1 Testing rules

To stay within this policy and the safe harbour in clause 7:

(a) do not access, change, copy or delete data that does not belong to you. You are not authorised to access, keep or change data of any Benvo client or its guests, members or staff beyond the minimum needed to show the problem. If you reach such data, stop at once, tell us at once, keep only what you need to show the problem until we confirm your report, then delete it and confirm to us that you have done so;

(b) never use an API key, access code or session you found. Report it so we can revoke it;

(c) keep automated testing under five requests a second, and do not run tests that could disrupt service for venues;

(d) do not run code on our servers beyond a minimal proof, and do not move further into our systems once you have shown the problem;

(e) do not test bookings, payments, messages or calls in a way that reaches a real venue, guest, phone number or card. Use your own test account; and

(f) keep the details confidential until we agree a disclosure date with you.

#5. How to report

#5.1 What to include

Email support@benvo.io with a subject that starts with "Security". Please include:

(a) what you found and what an attacker could do with it;

(b) the address, endpoint or part of the product affected;

(c) steps to reproduce, with a proof of concept, requests and responses or a short video;

(d) the account or test credentials you used, and the date, time and IP addresses of your testing; and

(e) whether and how you would like to be credited.

#5.2 Language and personal data

Reports in English are preferred. Please do not include personal data of other people in your report beyond what is needed to show the problem.

#6. What happens next

#6.1 Acknowledgement and validation

We will acknowledge your report within 3 business days and confirm whether it is a valid issue, with our view of its severity, within 10 business days.

#6.2 Updates and fix times

We will keep you updated at least every two weeks until it is fixed, and tell you when it is. We aim to fix critical issues within 7 days, high severity issues within 30 days and others within 90 days. We may ask you to check our fix.

#6.3 Personal data exposure

If a report shows that personal data of our clients or their guests may have been exposed, we will handle it as a security incident under our incident process and our agreements with our clients, including telling affected clients as those agreements require.

#7. Safe harbour

#7.1 Authorised research

If you make a good faith effort to follow this policy, we consider your research authorised. We will not take legal action against you or report you to law enforcement for it, and we will not bring claims under anti-hacking or anti-circumvention laws, or under our Website Terms of Use or Acceptable Use Policy, for activity that follows this policy.

#7.2 Third-party legal action

If a third party takes legal action against you for activity that followed this policy, we will make it known that your research was authorised by us.

#7.3 Limits of the safe harbour

This safe harbour does not cover activity that breaks the rules in clause 4, or the law in ways unrelated to your research. It cannot authorise testing of third-party services, which need their owners' permission. Our promise not to take action covers only Benvo's own claims: it cannot authorise access on behalf of our clients or anyone else, or waive their claims. If you are unsure whether something is allowed, ask us first at support@benvo.io.

#8. Coordinated disclosure

#8.1 Disclosure timing

Please give us a reasonable time to fix an issue before you publish anything about it. We ask for 90 days from your report, or until a fix is released if that is sooner, and we will agree the date with you.

#8.2 Public credit

When an issue is fixed we are happy to credit you publicly, by name or handle, unless you prefer not to be named.

#9. Rewards

#9.1 No bug bounty programme

Benvo does not run a bug bounty programme yet. We may choose to reward reports that help us fix a significant issue, at our discretion and depending on severity and the quality of the report.

#9.2 Reward conditions

A reward is not guaranteed, is not paid for out of scope reports or duplicates, and cannot be paid where the law does not allow it, including to sanctioned persons. We will announce a bug bounty programme on this page if one launches.

#10. Changes and contact

#10.1 Updates and contact

We may update this policy. The date at the top shows when it last changed. Security reports and questions about this policy go to support@benvo.io.