TeamEvo

    Vulnerability Disclosure Policy

    Effective 20 October 2026

    How to report a vulnerability

    Email your report to security@teamevo.co. Include:

    • the affected URL, domain, API, or component;
    • a description of the vulnerability and its potential impact;
    • clear steps to reproduce the issue;
    • the minimum supporting evidence needed, with unrelated personal data removed;
    • a way to contact you for follow-up questions.

    Do not send passwords, access tokens, full data exports, or other secrets. If a record identifier or redacted response is enough to demonstrate the issue, remove information that is not relevant to the vulnerability.

    Scope

    This policy applies to:

    • teamevo.co and its subdomains;
    • public TeamEvo web interfaces and APIs operated by TeamEvo.

    Customer-managed systems, third-party services, and supplier infrastructure are out of scope unless TeamEvo operates them directly. You may report a third-party component vulnerability when it affects TeamEvo, but you must not test another organisation's infrastructure without its permission.

    Testing rules

    When researching a vulnerability:

    • use your own accounts and test data;
    • perform only the actions needed to confirm the issue;
    • keep request rates low and avoid noticeable service load;
    • stop testing once you have sufficient evidence;
    • keep vulnerability details confidential until publication is coordinated.

    The following activities are prohibited:

    • denial of service, load testing, or high-volume automated scanning;
    • social engineering, phishing, spam, or attempts to gain access through employees or customers;
    • physical attacks or tests involving offices, equipment, or personnel;
    • modifying, deleting, encrypting, or copying data in bulk;
    • installing malware, establishing persistent access, or attempting to conceal activity;
    • testing third-party systems without separate permission from their owner.

    If you access data

    Stop testing immediately. Do not download, retain, share, or use the data. Tell us which categories of data may have been accessible and delete local copies if they were created automatically. Do not include the data itself in your report when the result can be explained without it.

    How we handle reports

    We aim to:

    • acknowledge a report within 3 business days;
    • provide an initial assessment within 10 business days;
    • provide a meaningful update at least once every 14 calendar days while the report remains open.

    Remediation time depends on severity, complexity, and the affected systems. We may ask for additional information or a safe retest of the fix.

    Coordinated disclosure

    Agree the publication date and scope with us before releasing technical details. We will share material remediation progress and will not unreasonably delay coordination. If you believe earlier publication is necessary, contact security@teamevo.co first so we can assess the risk to users.

    Good-faith research

    When research is conducted in good faith and follows this policy, we consider it authorised within the scope described above and will not initiate legal or law-enforcement action for those activities. If a third party initiates legal action over research that complies with this policy, we will confirm that the research was authorised by TeamEvo.

    This protection does not cover activity that violates the rules above, applicable law, or the rights of third parties.

    Rewards

    TeamEvo does not operate a public bug bounty programme. Submitting a report does not create an obligation to provide a monetary or other reward.

    Personal data and policy changes

    We use a researcher's contact details to investigate the report and communicate about it in accordance with our Privacy Policy.

    We may update this policy. The current version is always published on this page.