Security Disclosure

Send findings to admin@nvalt.ai with the subject line “Security disclosure”. Include reproduction steps, affected endpoints or versions, and any proof-of-concept you can share. We will provide a PGP key on request for sensitive reports.

We acknowledge every report within one business day, provide a triage assessment within five business days, and keep you updated until the issue is resolved. We will not pursue legal action against researchers who act in good faith under this policy.

nvalt.ai and its subdomains, the Nvalt platform API, the agent sandbox and its isolation boundaries, the CLI and official SDKs, and any authentication or authorisation surface across those systems.

Denial-of-service and volumetric testing, social engineering of our staff or customers, physical attacks, findings that require a fully compromised host, and reports produced solely by an automated scanner without a demonstrated impact.

Test only against accounts and workspaces you control. Do not access, modify or exfiltrate customer data. If you encounter customer data during testing, stop immediately and tell us. Give us reasonable time to remediate before any public write-up — we will agree a disclosure date with you.

With your permission we credit researchers in our release notes. Reports that demonstrate a material impact on the isolation model are eligible for a bounty at our discretion.