Responsible disclosure
Effective 16 October 2026 · Last updated 15 October 2026 · Version 1.0
How to report
Email hello@rivyva.com with "Security report" in the subject and steps to reproduce. In scope: this site and its subdomains, the GitHub App, the CLI and the GitHub Action. Out of scope: customers' apps, denial-of-service tests, social engineering and physical attacks.
Please
Don't access or change other people's data beyond what is needed to show the problem. Give us time to fix it before sharing it. Don't demand payment.
We will
Reply within 3 business days, keep you updated, credit you if you want, and not take legal action against good-faith research that follows this policy. We don't run a paid bug bounty at this time.