Vulnerability Disclosure

Introduction

At Novitora, we believe that working with skilled security researchers is essential to maintaining the safety and integrity of our file conversion platform. This policy is intended to provide clear guidelines for conducting security research and to establish a channel for reporting potential vulnerabilities.

We encourage security researchers to help us identify weaknesses in our systems before they can be exploited by malicious actors. In return, we commit to working with researchers in good faith, investigating all legitimate reports, and taking appropriate action to resolve confirmed vulnerabilities.

This policy applies to any vulnerabilities you discover in systems, applications, and services owned, operated, or maintained by Novitora.

Scope

In-scope systems

The following systems and services are within the scope of this policy:

1. Primary Web Application: The Novitora website and web application at novitora.com and all subdomains (*.novitora.com).
2. API Endpoints: All publicly accessible API endpoints used by the Novitora platform.
3. File Conversion Services: The file conversion pipeline, including file upload, processing, and download functionality.
4. Authentication and Account Systems: User authentication, registration, session management, and account recovery mechanisms.
5. Payment Processing Integration (once available): If and when we introduce paid plans, the integration points between Novitora and our payment processors will fall within scope (note: the payment processor's own systems are not in scope).

In-scope vulnerability types

We are particularly interested in the following types of vulnerabilities:

1. Remote code execution (RCE).
2. SQL injection and other injection vulnerabilities.
3. Cross-site scripting (XSS), including stored, reflected, and DOM-based variants.
4. Cross-site request forgery (CSRF).
5. Server-side request forgery (SSRF).
6. Authentication and authorisation bypass.
7. Insecure direct object references (IDOR).
8. Sensitive data exposure.
9. File upload vulnerabilities, including path traversal and unrestricted file types.
10. Privilege escalation.
11. Business logic vulnerabilities that could lead to data loss or unauthorised access.
12. Cryptographic weaknesses affecting data confidentiality or integrity.

How to report

Reporting channel

Please report all potential security vulnerabilities by email to:

security@novitora.com

Encryption

We encourage you to encrypt your report using our PGP key to protect sensitive information in transit. Our PGP public key is available upon request by emailing security@novitora.com with the subject line "PGP Key Request."

Report submission guidelines

To ensure we can investigate your report efficiently, please follow these guidelines:

1. Use a clear subject line: Include "Vulnerability Report" in the email subject, followed by a brief description (e.g., "Vulnerability Report - XSS in File Upload").
2. One vulnerability per report: Submit separate reports for each distinct vulnerability to facilitate tracking and resolution.
3. Provide sufficient detail: Include enough information for us to reproduce and validate the vulnerability (see "What to include" below).
4. Report promptly: Please report vulnerabilities as soon as reasonably possible after discovery.
5. Do not disclose publicly: Do not share details of the vulnerability with anyone else until we have had an opportunity to investigate and remediate it.

What to include

To help us triage and respond to your report quickly, please include the following information where applicable:

1. Vulnerability Description:

   • A clear and concise description of the vulnerability.
   • The type of vulnerability (e.g., XSS, CSRF, injection).
   • The potential impact if the vulnerability were exploited.

2. Affected System(s):

   • The URL, endpoint, or system component where the vulnerability was found.
   • The specific parameter, input field, or function affected.

3. Steps to Reproduce:

   • Detailed, step-by-step instructions for reproducing the vulnerability.
   • Any specific preconditions or configurations required.
   • Include screenshots, screen recordings, or proof-of-concept code where possible.

4. Proof of Concept:

   • A working proof-of-concept (PoC) that demonstrates the vulnerability.
   • PoC should be non-destructive and use minimal impact demonstrations.
   • Do not include any data belonging to other users in your PoC.

5. Environment Details:

   • Browser type and version (for web-based vulnerabilities).
   • Operating system.
   • Any tools or scripts used during testing.

6. Suggested Remediation (optional):

   • If you have suggestions for how the vulnerability might be fixed, we welcome them.

7. Your Contact Information:

   • A valid email address where we can reach you for follow-up questions.
   • Your name or alias (for recognition purposes, if desired).

Safe harbor

Our commitment to researchers

Novitora will not pursue legal action against security researchers who:

1. Make a good-faith effort to comply with this Vulnerability Disclosure Policy.
2. Avoid privacy violations, degradation of user experience, disruption to production systems, and destruction of data.
3. Do not exploit vulnerabilities beyond the minimum necessary to demonstrate the issue.
4. Report vulnerabilities promptly and do not disclose them publicly before we have had a reasonable opportunity to address them.
5. Do not access, modify, or delete data belonging to other users.
6. Do not use the vulnerability for financial gain or any purpose beyond demonstrating the security issue.

Conditions of safe harbor

Please note: This safe harbor applies only to legal claims under our control. It does not bind third parties or government authorities. However, we will advocate on your behalf if a third party initiates legal action against you for activities conducted in compliance with this policy.

To qualify for safe harbor protections, you must:

1. Act in good faith and in accordance with this policy at all times.
2. Not access or exfiltrate data beyond what is strictly necessary to demonstrate the vulnerability.
3. Cease testing and notify us immediately if you encounter any user data during your research.
4. Not perform any testing that could degrade the availability or performance of our services for other users.
5. Not conduct any form of social engineering, phishing, or physical security testing against Novitora employees or users.
6. Not perform denial-of-service (DoS) testing.

Response timeline

We are committed to responding to vulnerability reports in a timely manner. While we do not commit to fixed response times, we aim to:

1. Acknowledgement: Acknowledge receipt of your report promptly.
2. Initial Assessment: Provide an initial assessment, including whether we have been able to reproduce the vulnerability, as soon as reasonably practicable.
3. Status Updates: Keep you informed of the progress of our investigation until the matter is resolved.
4. Remediation: Remediate confirmed vulnerabilities as quickly as we reasonably can, prioritised according to severity and risk.
5. Resolution Notification: Notify you when the vulnerability has been remediated and invite you to verify the fix.
6. Disclosure Coordination: If you wish to publish your findings after the vulnerability has been resolved, we ask that you coordinate with us to ensure that the disclosure is accurate and does not inadvertently expose residual risks. We generally ask that you allow us a reasonable period, typically at least 90 days from the initial report, before any public disclosure.

Note: These are general aims rather than guarantees and may vary depending on the complexity of the vulnerability and the remediation required. We will communicate with you if we expect any delays.

Recognition

We believe in recognising the valuable contributions of security researchers who help us improve the security of our platform:

1. Acknowledgement: With your permission, we are happy to publicly credit your contribution once the issue has been resolved.
2. Credit: You may choose to be credited by your real name, an alias, or to remain anonymous.
3. Tokens of Appreciation: For significant findings, we may, at our discretion, offer a token of appreciation.
4. Reference Letters: For exceptional contributions, we are happy to provide reference letters attesting to your skills and professionalism.

Note: At this time, Novitora does not operate a paid bug bounty programme. We may introduce financial rewards in the future and will update this policy accordingly.

Out of scope

The following activities and vulnerability types are considered out of scope for this policy:

Out-of-scope activities

1. Physical attacks against Novitora offices, data centres, or employees.
2. Social engineering attacks (phishing, vishing, pretexting) against Novitora employees, contractors, or users.
3. Denial-of-service (DoS) or distributed denial-of-service (DDoS) attacks.
4. Spamming or flooding of forms, contact pages, or user interfaces.
5. Automated scanning that generates significant traffic or could degrade service performance.
6. Testing on systems or services not listed in the "Scope" section above.
7. Accessing, modifying, or deleting data belonging to other users.

Out-of-scope vulnerability types

1. Vulnerabilities in third-party services, plugins, or software not developed or maintained by Novitora (please report these to the respective vendor).
2. Clickjacking on pages with no sensitive actions.
3. Self-XSS (cross-site scripting that only affects the user's own session with no impact on others).
4. Missing HTTP security headers that do not lead to a demonstrable vulnerability (e.g., missing X-Frame-Options on non-sensitive pages).
5. CSRF on forms that do not perform sensitive actions (e.g., search forms, logout).
6. Missing cookie flags on non-sensitive cookies.
7. Information disclosure in HTTP headers or error messages that does not reveal sensitive data or facilitate further exploitation.
8. SSL/TLS configuration issues that are theoretical and not practically exploitable.
9. Content injection without demonstrated impact.
10. Rate limiting issues that do not lead to a significant security impact.
11. Username or email enumeration through standard login or registration flows.
12. Vulnerabilities that require significant user interaction or are highly unlikely to be exploited in practice.

Legal protections

Applicable law

This Vulnerability Disclosure Policy is governed by the laws of England and Wales. Any disputes arising from or relating to this policy shall be subject to the exclusive jurisdiction of the courts of England and Wales.

Computer Misuse Act 1990

We recognise that security research conducted in good faith and in accordance with this policy may involve activities that could technically fall within the scope of the Computer Misuse Act 1990. We will not pursue prosecution under this Act for research conducted in compliance with this policy.

Important: This safe harbor is contingent upon full compliance with the terms and conditions of this policy. Activities that exceed the scope of this policy or violate its terms may not be protected.

Regulatory considerations

1. If your research reveals a data protection concern that may require notification to the Information Commissioner's Office (ICO), please include this in your report so we can assess our obligations under the UK GDPR and Data Protection Act 2018.
2. We will handle all vulnerability reports in accordance with applicable data protection laws, including with respect to any personal data contained in or referenced by the report.

Confidentiality

1. We will treat your vulnerability report as confidential and will not share your personal information with third parties without your consent, except as required by law.
2. We may share non-identifying details of the vulnerability with our service providers, auditors, or regulators where necessary for remediation or compliance purposes.

Responsible conduct

We expect all participants in this programme to conduct themselves responsibly and ethically:

1. Minimise Impact: Use the least invasive methods possible to demonstrate a vulnerability. Do not exploit a vulnerability beyond what is necessary for a proof of concept.
2. Protect Privacy: Do not access, collect, or store personal data of other users. If you inadvertently encounter personal data, stop testing immediately, do not save or share the data, and notify us in your report.
3. Respect Boundaries: Stay within the scope defined in this policy. If you are unsure whether a particular system or activity is in scope, ask us before proceeding.
4. Act Lawfully: Comply with all applicable laws in addition to the terms of this policy.

Changes to this policy

We may update this Vulnerability Disclosure Policy from time to time. Material changes will be communicated through our website. We encourage you to review this policy periodically for the latest information.

Contact

For all vulnerability reports and questions about this policy, please contact us:

• Security Email: security@novitora.com
• General Legal Email: legal@novitora.com
• Postal Address: Uptraff Ltd, 124 City Road, London, England, EC1V 2NX
• Website: https://novitora.com

Thank you for helping us keep Novitora and our users safe. Your contributions to the security of our platform are valued and appreciated.

This Vulnerability Disclosure Policy is effective as of 23 February 2026 and will be reviewed and updated periodically.