Responsible Disclosure

We are dedicated to maintaining the security and privacy of the Conveyor services and customer data. We welcome security researchers from the community who want to help us improve our products and services.

If you discover a security vulnerability, please give us the chance to fix it by emailing us at disclosure@conveyor.com. Publicly disclosing a security vulnerability without informing us first puts the rest of the community at risk. When you notify us of a potential problem, we will work with you to make sure we understand the scope and cause of the issue.
‍

Conveyor's security research program is private. You are not authorized to test any Conveyor service until you have submitted an Authorization Request and received written approval from Conveyor Security (see Authorization, below). If you discover a vulnerability without testing, for example while using Conveyor as a customer, please report it anyway. We will review it as a good-faith disclosure, although it is not eligible for a reward.

Trust centers that Conveyor hosts for our customers, including any on a customer's own domain (e.g. trust.customer.com), are strictly out of scope. Submitting access requests, questions, or NDA signatures to a customer's trust center is unauthorized access to that customer's system. Testing them is unauthorized and will result in a permanent ban from this program.

Authorization

To request authorization, email disclosure@conveyor.com with the subject line "Authorization Request: [your name]" and include:

• Your full name and the email address you will use for all testing accounts and correspondence.
• Links to any researcher profiles (HackerOne, Bugcrowd, Intigriti, GitHub, published advisories).
• The in-scope services you intend to test.
• The type of testing you plan to complete: the vulnerability classes you will look for, your techniques, and the tools you will use.
• Confirmation that you have read this policy and will follow it.

You are not approved to test Conveyor until you have obtained written approval. Authorization may be revoked at any time.

Rules

• NEVER attempt to gain access to another user's account or data. If you encounter data that is not yours, stop immediately, do not retain it, and report it the same day.
• NEVER attempt to degrade the services.
• NEVER impact other users with your testing.
• Test only on in-scope services, listed below, and only from organizations and accounts you created under your authorization.
• NEVER interact with a trust center that Conveyor hosts for a customer, in any way.
• Do not send video proof of concepts.
• Do not use fuzzers, scanners, or other automated tools to find vulnerabilities.
• Do not include live tokens, passwords, or scripts in reports. Include written reproduction steps you have personally verified, one issue per report.
• Do not publicly disclose an issue until we have fixed it and agreed on disclosure.

Breaking any of these rules ends your authorization, forfeits any pending reward, and may result in a permanent ban from this program.

In-Scope Services

Only the following services are in-scope, within organizations you created for research:

• app.conveyor.com
• api.conveyor.com
• auth.conveyor.com
• trust.conveyor.com (Conveyor's own trust center only)
• mcp.conveyor.com and visitor-mcp.conveyor.com

Please do not test or report issues with services not listed here, especially our marketing site www.conveyor.com, or with third-party services we rely on. Report issues in a third-party service to that vendor.

Out-of-Scope Issues

The following types of reports/attacks are out of scope. Do not attempt them:

• Reports about any service not listed under "In-Scope Services," above
• DOS attacks
• Brute force attacks
• Physical vulnerabilities
• Social engineering attacks, including but not limited to:
  • phishing
  • email auth (SPF, DKIM, etc.)
  • hyperlink injection in emails
  • OAuth consent phishing, including via dynamically registered MCP clients
• Dynamic client registration, public PKCE clients, and credential-less CORS on our OAuth/MCP endpoints (intended behavior per the MCP specification)
• CSRF on forms that are available to anonymous users (e.g., signup, login, contact, Intercom)
• Self-XSS and issues exploitable only through self-XSS
• Clickjacking and issues only exploitable through clickjacking
• Functional, UI and UX bugs and spelling mistakes
• Descriptive error messages (e.g. stack traces, application or server errors)
• HTTP 404 codes/pages or other HTTP error codes/pages
• Banner disclosure on common/public services
• Disclosure of known public files or directories, (e.g. robots.txt)
• Presence of application or web browser "autocomplete" or "save password" permission
• User enumeration on pages such as "login" or "forgot password"
• Absence of rate limits
• EXIF on public images such as company logo
• Issues that require an attacker who is already an administrator of the victim organization
• Vulnerabilities in third-party libraries without a demonstrated exploit path in a Conveyor service

Rewards

Conveyor awards authorized security researchers cash for reporting in scope vulnerabilities in accordance with this policy. We reserve the right to change or discontinue rewards at any time. Rewards will be issued via bill.com and additional documentation may be required based on residence of the researcher.

Severity is assigned by Conveyor after technical triage and adjustment for realistic preconditions. The first valid report of an issue is rewarded; duplicates are not. One reward is paid per root cause, after the fix is deployed or the issue is formally accepted. Reports generated by automated or AI tools without a researcher-verified reproduction are not eligible.

• Critical - $250-$500: Remote code execution; broken access control leading to unauthorized access to another organization's data or account without user interaction
• High - $100-$250: Cross-organization data exposure with significant preconditions; privilege escalation; stored XSS reaching other organizations
• Medium - $50-$100: Authorization flaws between roles in the same organization; reflected XSS
• Low - $25-$50: defense-in-depth gaps we choose to fix

What to Expect

We strive to acknowledge in scope reports from authorized researchers within 3 business days and aim to give a triage decision within 10 business days. Out-of-scope and unauthorized reports may not receive a response. Please do not follow up on an open report more than once every 10 business days unless you have new information. Due to an influx in reports, triage time may take longer.

Top Researchers

Researchers are listed here based on adherence to these program guidelines, professionalism, and significance or novelty of the issue(s) reported:

• Dr. Jens Müller
• Aniket Kudale
• Imran Parray
• Siddharth Pasalapudi
• Tinu Tomy
• Shail Patel
• KK Global Solutions
• Rituparn Pant
• Aryan Rohit

Updates

We may update this policy at any time. The version and effective date at the top of this page are authoritative.