Responsible Disclosure

We are dedicated to maintaining the security and privacy of the Conveyor services and customer data. We welcome security researchers from the community who want to help us improve our products and services.

If you discover a security vulnerability, please give us the chance to fix it by emailing us at security@conveyor.com. Publicly disclosing a security vulnerability without informing us first puts the rest of the community at risk. When you notify us of a potential problem, we will work with you to make sure we understand the scope and cause of the issue.
‍

We strive to reply to all reports within 72 hours. However, due to an influx in reports triage time may take longer. If you submit an out of scope report, do not expect to receive a response.

Trust centers that Conveyor hosts for our customers, including any on a customer's own domain (e.g. trust.customer.com), are strictly out of scope. Testing them is unauthorized and will result in a permanent ban from this program.

Thank you for your work and interest in making the community safer and more secure!

Bounty Program

Conveyor awards security researchers cash and prizes for reporting in scope vulnerabilities. Please email security@conveyor.com to report an issue.


If you would like to be eligible for a bounty, please read this carefully. We reserve the right to discontinue issuing bounties at any time. Bounties will be issued via bill.com and additional documentation may be required based on residence of the researcher.

We strive to reply to all reports within 72 hours. However, if you submit an out of scope report we may not be able to reply to all out of scope reports.

Rules

1. NEVER attempt to gain access to another user's account or data.
2. NEVER attempt to degrade the services.
3. NEVER impact other users with your testing.
4. Test only on in-scope domains, listed below.
5. Do not send video proof of concepts.
6. Do not use fuzzers, scanners, or other automated tools to find vulnerabilities

Doing any of the above will render you ineligible for cash bounties and prizes.

In-Scope Services

Only the following services are in-scope:

• app.conveyor.com
• api.conveyor.com
• auth.conveyor.com
• trust.conveyor.com
• mcp.conveyor.com

Please do not test or report issues with services not listed here, especially our marketing site www.conveyor.com.

Out-of-Scope Issues

The following types of reports/attacks are out of scope. Do not attempt them:

• Reports about any service not listed under "In-Scope Services," above
• DOS attacks
• Brute force attacks
• Physical vulnerabilities
• Social engineering attacks, including but not limited to:
• phishing
• email auth (SPF, DKIM, etc.)
• hyperlink injection in emails
• Dynamic client registration, public PKCE clients, and credential-less CORS on our OAuth/MCP endpoints (intended behavior per the MCP specification)
• CSRF on forms that are available to anonymous users (e.g., signup, login, contact, Intercom)
• Self-XSS and issues exploitable only through self-XSS
• Clickjacking and issues only exploitable through clickjacking
• Functional, UI and UX bugs and spelling mistakes
• Descriptive error messages (e.g. stack traces, application or server errors)
• HTTP 404 codes/pages or other HTTP error codes/pages
• Banner disclosure on common/public services
• Disclosure of known public files or directories, (e.g. robots.txt)
• Presence of application or web browser "autocomplete" or "save password" permission
• User enumeration on pages such as "login" or "forgot password"
• Absence of rate limits
• EXIF on public images such as company logo

Top Researchers

Researchers are listed here based on adherence to these program guidelines, professionalism, and significance or novelty of the issue(s) reported:

• Dr. Jens Müller
• Aniket Kudale
• Imran Parray
• Siddharth Pasalapudi
• Tinu Tomy
• Shail Patel
• KK Global Solutions
• Rituparn Pant
• Aryan Rohit

Updates

We may periodically update the scope and guidelines of our program so please check back here periodically.