Only the latest version of jovVix receives security updates.
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, please report them via email to security@improwised.com.
You should receive a response within 48 hours. If for some reason you do not, please follow up to ensure we received your original message.
Please include the following information in your report:
- Type of issue (e.g., SQL injection, XSS, authentication bypass)
- Full paths of source file(s) related to the manifestation of the issue
- The location of the affected source code (tag/branch/commit or direct URL)
- Any special configuration required to reproduce the issue
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if possible)
- Impact of the issue, including how an attacker might exploit it
This information will help us triage your report more quickly.
- Acknowledgment: We will acknowledge receipt of your vulnerability report within 48 hours.
- Assessment: We will confirm the vulnerability and determine its impact.
- Fix: We will develop a fix and prepare a release.
- Disclosure: We will coordinate with you on the timing of public disclosure.
We aim to resolve critical vulnerabilities within 7 days of confirmation.
We support safe harbor for security researchers who:
- Make a good faith effort to avoid privacy violations, data destruction, or disruption to our services
- Only interact with accounts you own or with explicit permission of the account holder
- Do not exploit a vulnerability beyond what is necessary to confirm its existence
- Report vulnerabilities promptly and do not publicly disclose them until a fix is available
We will not pursue legal action against researchers who follow these guidelines.
This security policy applies to:
- The jovVix application (frontend and backend)
- Docker deployment configurations
- API endpoints and authentication flows
This security policy does NOT apply to:
- Third-party services or dependencies (report these to their maintainers)
- Social engineering attacks against maintainers or contributors