Security & Responsible Disclosure
RELAVANZ welcomes good-faith reports that help us identify and address security vulnerabilities. This page explains how to report an issue and the testing boundaries that protect customers and connected providers.
Scope
This policy covers security issues in RELAVANZ-owned websites, applications, APIs, and infrastructure that you are authorized to test. It does not authorize testing of customer Sites, customer-controlled repositories or accounts, or third-party provider systems.
Report a vulnerability
Email hello@relavanz.com with a clear subject such as "Security report." Do not include secret credentials or unnecessary customer personal data.
What to include
- the affected RELAVANZ URL, feature, or integration;
- a concise description of the issue and potential impact;
- reproduction steps that avoid destructive actions;
- relevant request/response details with secrets redacted;
- your preferred contact information for follow-up.
Good-faith testing boundaries
Use only accounts, Workspaces, Sites, integrations, and data you own or are explicitly authorized to test. Keep request volume low and stop if testing risks affecting other users or service availability.
- Do not access or modify another customer's data.
- Do not use stolen, guessed, or leaked credentials.
- Do not perform denial-of-service, resource-exhaustion, spam, or destructive tests.
- Do not social-engineer RELAVANZ personnel, customers, or provider personnel.
- Do not test Google, Shopify, GitHub, WordPress, Stripe, OpenAI, or another third-party service through RELAVANZ unless that provider separately authorizes the testing.
- Do not exfiltrate data beyond the minimum needed to demonstrate the issue.
How RELAVANZ handles reports
RELAVANZ will review credible reports, prioritize them based on risk, and may request additional information. We do not promise a fixed response or remediation deadline in this public policy, because severity and investigation requirements vary.
Coordinated disclosure
Please give RELAVANZ a reasonable opportunity to investigate and address a reported issue before public disclosure. We may coordinate timing and technical details with you where appropriate.
No unsupported certification claims
RELAVANZ publishes only security claims supported by current product evidence. This page does not claim SOC 2, ISO 27001, a specific penetration-test cadence, perfect security, or guaranteed uptime.
Security architecture overview
Current RELAVANZ architecture uses authenticated Workspace boundaries, tenant scoping, row-level security, server-side secret storage, capability-gated integrations, signed service-to-service requests, lease/fencing controls for worker execution, and separation between implementation completion and fresh live verification.
Contact
Security reports: hello@relavanz.com.