Security & Responsible Disclosure

DRAFT, not yet reviewed by a lawyer.
Effective date: [EFFECTIVE DATE]
Last updated: 11 November 2026

GLAV is a security product, and we hold ourselves to the standard we help our customers reach. This page summarises how we protect the platform and customer data, and how to report a vulnerability to us.

1. How we protect the platform

Tenant isolation. Each customer’s projects, targets, findings and reports are logically separated from those of every other customer, and access is enforced on every request.

Isolated test workers. Pentest engines run in isolated, containerised workers that are separate from our core application and from other customers’ runs.

Scope and authorisation gate. Every test is checked against the customer’s verified, in-scope assets before it runs. Requests for out-of-scope or unverified targets are blocked.

Domain and asset verification. Customers must verify control of targets before testing them.

Audit logs. We log significant account and test activity, including who started which test, against which target, with which settings and when.

Encryption in transit. Traffic to and from glav.ai and our APIs is encrypted using TLS.

Encryption at rest.

Infrastructure. We run on established cloud providers, listed on our Subprocessors page.

Access control. Access to production systems by GLAV personnel is limited to those who need it.

2. Responsible disclosure policy

We welcome reports from security researchers. If you believe you have found a vulnerability in GLAV, please tell us so we can fix it.

2.1 How to report

Email [SECURITY CONTACT EMAIL] with:

• a description of the vulnerability and its potential impact;

• the affected URL, endpoint or component;

• step-by-step instructions or a proof of concept to reproduce it; and

• your name or handle, if you would like to be credited.

[OPTIONAL: PGP KEY URL]

Please do not report vulnerabilities through public channels, social media or support chat.

2.2 What to expect

• We will acknowledge your report within [ACKNOWLEDGEMENT TIME].

• We will give an initial assessment within [TRIAGE TIME].

• We will keep you informed of progress and aim to resolve valid issues within [TARGET REMEDIATION TIME], depending on severity.

• With your permission, we will credit you once the issue is fixed.

2.3 In scope

• glav.ai and its subdomains operated by GLAV [LIST SPECIFIC HOSTS]

• The GLAV web application and APIs

• Tenant isolation and authorisation controls, including the scope gate

• Report generation and sharing features

2.4 Out of scope

• Systems belonging to our customers or their clients, including any target tested through GLAV;

• Third-party services we use (for example our hosting, database, email and payment providers). Please report those to the provider directly;

• Polar’s checkout and customer portal;

• Denial-of-service, load or stress testing;

• Social engineering, phishing or physical attacks against GLAV staff, offices or customers;

• Spam, or reports from automated scanners without a demonstrated, exploitable impact;

• Missing security headers, cookie flags or email (SPF/DKIM/DMARC) settings without demonstrated impact;

• Clickjacking on pages without sensitive actions;

• Issues that require a compromised device, outdated browser, or physical access to a victim’s device; and

• Vulnerabilities in third-party or open-source components that are already publicly known, unless you show a specific impact on GLAV.

2.5 Rules of engagement

When researching, you must:

• use only accounts you own or have created for testing, and never access, modify or delete data belonging to other users or customers. If you encounter such data, stop, do not keep it, and tell us;

• not degrade the availability of the Service or interfere with other users;

• not use GLAV to launch tests against any target you are not authorised to test;

• not attempt to bypass the scope gate to reach third-party systems. Report the bypass instead, demonstrating it only against assets you own;

• stop and report as soon as you have confirmed a vulnerability, without exploiting it further or pivoting to other systems; and

• keep the details confidential until we have fixed the issue and agreed a disclosure date with you, or [COORDINATED DISCLOSURE PERIOD] have passed since your report, whichever is sooner.

2.6 Safe harbor

If you make a good-faith effort to comply with this policy, we will consider your research authorised, we will not take legal action against you or ask law enforcement to investigate you for that research, and we will make this authorisation known if a third party takes action against you for activities that complied with this policy. This safe harbor covers only systems owned and operated by GLAV and does not authorise testing of third-party systems, including our providers and our customers’ targets. It cannot bind third parties or public authorities. If you are unsure whether an activity is allowed, ask us at [SECURITY CONTACT EMAIL] first. (Flagged for legal review against Croatian criminal law.)

2.7 No bug bounty

We do not currently run a paid bug bounty programme. We do not offer payment for reports, and reports made with demands for payment will not be treated as good-faith research under this policy.

3. security.txt

We publish a security.txt file in line with RFC 9116 so researchers can find this policy and our contact details. [PUBLISH THE FILE BEFORE THIS PAGE GOES LIVE]

4. Reporting abuse

If you believe GLAV is being used to test your systems without authorisation, please contact [SECURITY CONTACT EMAIL]. See our Acceptable Use & Authorized Testing Policy.