# Vulnerability disclosure policy > How to report a security vulnerability in Benvo, what is in scope, our safe harbour for good faith research and how quickly we respond. Source: https://benvo.io/security/disclosure On this pageIn scopeOut of scopeRules for testingHow to reportWhat happens nextSafe harbourCoordinated disclosureRewardsContactLegal[Privacy notice](https://benvo.io/legal/privacy)[Terms of use](https://benvo.io/legal/terms)[Cookie notice](https://benvo.io/legal/cookies)[Vulnerability disclosure](https://benvo.io/security/disclosure) Security # Vulnerability disclosure policy Last updated Thu 5 Nov 2026 We welcome reports from security researchers. If you believe you have found a vulnerability in Benvo, tell us at support@benvo.io and we will work with you to understand and fix it. This policy explains what you may test, how to report it and what you can expect from Coviola Group LLC in return. ## #In scope These services are in scope. Test only with accounts you created yourself or credentials we gave you for testing. - benvo.io and its subdomains, including the website, status.benvo.io and venue pages we host. - The client app at app.benvo.io, the members app and the booking and enquiry forms it serves. - The Benvo Console at console.benvo.io. Sign in is limited to the Benvo team, so report what you can observe without an account. - The POS at pos.benvo.io and the device pairing flow. - The developer portal at developers.benvo.io and the public API at api.benvo.io, including API keys, webhooks and request signing. - The official Benvo SDKs published by us. ## #Out of scope These are out of scope and are not eligible for a reward. Report them only if you can show a real impact on the security of Benvo or its users. - Reports from automated scanners without a working proof of impact. - Missing security headers, cookie flags or email records such as SPF, DKIM and DMARC, without a demonstrated attack. - Clickjacking on pages with no sensitive action, self cross-site scripting, and cross-site request forgery on sign in or sign out. - Rate limits on endpoints that do not affect accounts, money or data. - Denial of service, load or stress testing, and anything that degrades the service for others. - Social engineering, phishing or physical attacks against our team, our customers, their guests or staff. - Services run by third parties, such as payment, messaging or hosting providers. Report those to the provider. - Websites on a venue's own domain that Benvo does not host, and accounts, data or devices that do not belong to you. - Software version disclosure, content spoofing without HTML injection, and issues that only affect outdated browsers or rooted devices. ## #Rules for testing To stay within this policy and the safe harbour below: - Do not access, change, copy or delete data that does not belong to you. If you reach another account's data, stop, keep only what you need to show the problem and tell us at once. - Never use an API key, access code or session you found. Report it so we can revoke it. - Keep automated testing under five requests a second, and do not run tests that could disrupt service for venues. - Do not run code on our servers beyond a minimal proof, and do not move further into our systems once you have shown the problem. - Do not test bookings, payments or messages in a way that reaches a real venue, guest or card. Use your own test account. - Keep the details confidential until we agree a disclosure date with you. ## #How to report Email support@benvo.io with a subject that starts with "Security". Please include: - What you found and what an attacker could do with it. - The address, endpoint or part of the product affected. - Steps to reproduce, with a proof of concept, requests and responses or a short video. - The account or test credentials you used, and the date, time and IP addresses of your testing. - Whether and how you would like to be credited. ## #What happens next We will acknowledge your report within 3 business days and confirm whether it is a valid issue, with our view of its severity, within 10 business days. We will keep you updated at least every two weeks until it is fixed, and tell you when it is. We aim to fix critical issues within 7 days, high severity issues within 30 days and others within 90 days. We may ask you to check our fix. ## #Safe harbour If you make a good faith effort to follow this policy, we consider your research authorised. We will not take legal action against you or report you to law enforcement for it, and we will not bring claims under anti-hacking or anti-circumvention laws, or under our terms of use, for activity that follows this policy. If a third party takes legal action against you for activity that followed this policy, we will make it known that your research was authorised by us. This safe harbour does not cover activity that breaks the rules above or the law in ways unrelated to your research. If you are unsure whether something is allowed, ask us first. ## #Coordinated disclosure Please give us a reasonable time to fix an issue before you publish anything about it. We ask for 90 days from your report, or until a fix is released if that is sooner, and we will agree the date with you. When an issue is fixed we are happy to credit you publicly, by name or handle, unless you prefer not to be named. ## #Rewards Benvo does not run a bug bounty programme yet. We may choose to reward reports that help us fix a significant issue, at our sole discretion and depending on severity and the quality of the report. A reward is not guaranteed, is not paid for out of scope reports or duplicates, and cannot be paid where the law does not allow it. We will announce a bug bounty programme on this page when it launches. ## #Contact Security reports and questions about this policy go to support@benvo.io. Our security.txt file is at https://benvo.io/.well-known/security.txt.