# Responsible Disclosure Policy > Found a vulnerability in Benvo? Email support@benvo.io with a subject starting "Security". Source: https://benvo.io/legal/responsible-disclosure Security # Responsible Disclosure Policy - Version 1.0.0 - Effective Sat 7 Nov 2026 - Last updated Fri 6 Nov 2026 Key points Plain English, not legally binding - Found a vulnerability in Benvo? Email [support@benvo.io](mailto:support@benvo.io) with a subject starting "Security". - Test only with your own accounts, never touch other people's data, and do not disrupt the service. This policy cannot authorise access to our clients' or their guests' data. - We reply within 3 business days, aim to fix critical issues within 7 days, and agree a disclosure date with you. - Good faith research under this policy is authorised, and we will not take legal action against you for it. - We do not run a bug bounty programme yet. This box is a summary only. The clauses below are the binding text. ## #1. About this policy ### #1.1 Purpose of this policy We welcome reports from security researchers. This policy explains what you may test, how to report what you find and what you can expect from Coviola Group LLC (trading as Benvo), a Wyoming limited liability company (original filing ID 2026-001898597), 30 N Gould St, Sheridan, WY 82801, USA ("Benvo", "we", "us"), in return. It is published at [https://benvo.io/legal/responsible-disclosure](https://benvo.io/legal/responsible-disclosure) and is the policy referred to in our security.txt file at [https://benvo.io/.well-known/security.txt](https://benvo.io/.well-known/security.txt). ## #2. In scope ### #2.1 Services in scope These services are in scope. Test only with accounts you created yourself or credentials we gave you for testing. (a) benvo.io and its subdomains, including the website, status.benvo.io, docs.benvo.io and venue pages we host (for venue pages, only Benvo's platform is in scope, not the venue's own systems or data); (b) the client app at app.benvo.io, the members app and the booking and enquiry forms it serves; (c) the Benvo Console at console.benvo.io (sign-in is limited to the Benvo team, so report what you can observe without an account); (d) the POS at pos.benvo.io and the device pairing flow; (e) the developer portal at developers.benvo.io and the public API at api.benvo.io, including API keys, webhooks and request signing; and (f) the official Benvo software development kits we publish. ## #3. Out of scope ### #3.1 Out of scope issues These are out of scope and not eligible for any reward. Report them only if you can show a real impact on the security of Benvo or its users. (a) Reports from automated scanners without a working proof of impact. (b) Missing security headers, cookie flags or email records such as SPF, DKIM and DMARC, without a demonstrated attack. (c) Clickjacking on pages with no sensitive action, self cross-site scripting, and cross-site request forgery on sign-in or sign-out. (d) Rate limits on endpoints that do not affect accounts, money or data. (e) Denial of service, load or stress testing, and anything that degrades the service for others. (f) Social engineering, phishing or physical attacks against our team, our clients, their guests or staff. (g) Services run by third parties, such as payment, messaging or hosting providers. Report those to the provider. (h) Websites on a venue's own domain that Benvo does not host, and accounts, data or devices that do not belong to you. (i) Software version disclosure, content spoofing without HTML injection, and issues that only affect outdated browsers or rooted devices. ## #4. Rules for testing ### #4.1 Testing rules To stay within this policy and the safe harbour in clause 7: (a) do not access, change, copy or delete data that does not belong to you. You are not authorised to access, keep or change data of any Benvo client or its guests, members or staff beyond the minimum needed to show the problem. If you reach such data, stop at once, tell us at once, keep only what you need to show the problem until we confirm your report, then delete it and confirm to us that you have done so; (b) never use an API key, access code or session you found. Report it so we can revoke it; (c) keep automated testing under five requests a second, and do not run tests that could disrupt service for venues; (d) do not run code on our servers beyond a minimal proof, and do not move further into our systems once you have shown the problem; (e) do not test bookings, payments, messages or calls in a way that reaches a real venue, guest, phone number or card. Use your own test account; and (f) keep the details confidential until we agree a disclosure date with you. ## #5. How to report ### #5.1 What to include Email [support@benvo.io](mailto:support@benvo.io) with a subject that starts with "Security". Please include: (a) what you found and what an attacker could do with it; (b) the address, endpoint or part of the product affected; (c) steps to reproduce, with a proof of concept, requests and responses or a short video; (d) the account or test credentials you used, and the date, time and IP addresses of your testing; and (e) whether and how you would like to be credited. ### #5.2 Language and personal data Reports in English are preferred. Please do not include personal data of other people in your report beyond what is needed to show the problem. ## #6. What happens next ### #6.1 Acknowledgement and validation We will acknowledge your report within 3 business days and confirm whether it is a valid issue, with our view of its severity, within 10 business days. ### #6.2 Updates and fix times We will keep you updated at least every two weeks until it is fixed, and tell you when it is. We aim to fix critical issues within 7 days, high severity issues within 30 days and others within 90 days. We may ask you to check our fix. ### #6.3 Personal data exposure If a report shows that personal data of our clients or their guests may have been exposed, we will handle it as a security incident under our incident process and our agreements with our clients, including telling affected clients as those agreements require. ## #7. Safe harbour ### #7.1 Authorised research If you make a good faith effort to follow this policy, we consider your research authorised. We will not take legal action against you or report you to law enforcement for it, and we will not bring claims under anti-hacking or anti-circumvention laws, or under our [Website Terms of Use](https://benvo.io/legal/website-terms) or Acceptable Use Policy, for activity that follows this policy. ### #7.2 Third-party legal action If a third party takes legal action against you for activity that followed this policy, we will make it known that your research was authorised by us. ### #7.3 Limits of the safe harbour This safe harbour does not cover activity that breaks the rules in clause 4, or the law in ways unrelated to your research. It cannot authorise testing of third-party services, which need their owners' permission. Our promise not to take action covers only Benvo's own claims: it cannot authorise access on behalf of our clients or anyone else, or waive their claims. If you are unsure whether something is allowed, ask us first at [support@benvo.io](mailto:support@benvo.io). ## #8. Coordinated disclosure ### #8.1 Disclosure timing Please give us a reasonable time to fix an issue before you publish anything about it. We ask for 90 days from your report, or until a fix is released if that is sooner, and we will agree the date with you. ### #8.2 Public credit When an issue is fixed we are happy to credit you publicly, by name or handle, unless you prefer not to be named. ## #9. Rewards ### #9.1 No bug bounty programme Benvo does not run a bug bounty programme yet. We may choose to reward reports that help us fix a significant issue, at our discretion and depending on severity and the quality of the report. ### #9.2 Reward conditions A reward is not guaranteed, is not paid for out of scope reports or duplicates, and cannot be paid where the law does not allow it, including to sanctioned persons. We will announce a bug bounty programme on this page if one launches. ## #10. Changes and contact ### #10.1 Updates and contact We may update this policy. The date at the top shows when it last changed. Security reports and questions about this policy go to [support@benvo.io](mailto:support@benvo.io).