CORVUS badge CORVUS
Back to home
Trust & Security

Bug Bounty Program

How to report security vulnerabilities in CORVUS, and how we respond. Last updated: October 8, 2026.

Found a vulnerability? Report it privately to the CORVUS team with the details. Please do not disclose it publicly or share it with anyone else until we have had a chance to fix it.

Rewards

CORVUS is an early-stage product and we do not currently offer cash rewards. With your permission, we will thank everyone who reports a valid, previously unknown issue on our acknowledgements list below.

In scope

  • The CORVUS website and dashboard at corvus-terminal-tsdr.vercel.app, including all pages served from it.
  • CORVUS data accessed through the public database API that the website uses, for example any way to change, delete or insert signals, or to read data that is not shown on the site.

What we are most interested in

  • Cross-site scripting (XSS) or other ways to run code in a visitor's browser.
  • Any way to tamper with, inject or delete signals, risk scores or other stored data.
  • Exposure of secrets, credentials or non-public data.
  • Issues that let someone alter what visitors see on the live site.

Out of scope

  • Third-party services we use, such as Vercel, Supabase, GitHub, Binance, CoinGecko and Google Fonts. Please report problems in those services to their owners.
  • Denial-of-service, load or volumetric testing.
  • Social engineering, phishing or physical attacks against CORVUS or its users.
  • Reports from automated scanners without a demonstrated, practical impact.
  • Missing security headers, cookie flags or best-practice recommendations with no exploitable impact.
  • Clickjacking on pages with no sensitive actions, self-XSS, and issues that need an already-compromised device.
  • The public database key embedded in the website. It is meant to be public; only report it if you can use it to do something the site itself does not do, such as writing or deleting data.

Rules of engagement

  • Only test against data you create or that is already public. Stop and report as soon as you can show the issue.
  • Do not modify or delete data that is not yours, and do not degrade the Service for other people.
  • Do not use automated tools that send high volumes of requests.
  • Keep the details confidential until we confirm the issue is fixed, and give us a reasonable amount of time to fix it, normally up to 90 days.

How to report

Send your report to the CORVUS team (a dedicated security address will be published here before public launch) and include:

  • a description of the issue and where it is;
  • clear steps to reproduce it, with a proof of concept if you have one;
  • what an attacker could achieve with it;
  • how you would like to be credited, if at all.

What happens next

We aim to acknowledge your report within 5 business days, keep you updated while we investigate, and let you know when the issue is fixed. If we decide a report is not a vulnerability or is out of scope, we will tell you why.

Safe harbor

If you make a good-faith effort to follow this policy, we will consider your research authorized, we will not pursue legal action against you for it, and we will work with you to understand and fix the issue. If you are unsure whether something is allowed, ask us first.

Acknowledgements

No reports yet. Be the first.