Kyvvu takes the security of its products and services seriously. As an Agent Security Kernel for AI agents, the trustworthiness of our platform is core to what we do. We appreciate the work of security researchers who help us identify and remediate vulnerabilities, and we want to make it easy and safe for you to report them.
This policy describes the rules for reporting a vulnerability you have discovered in Kyvvu’s products or systems.
How to submit a vulnerability
Send your report to security@kyvvu.com. We also publish a security.txt at /.well-known/security.txt pointing to this policy and the intake mailbox.
Please include:
- A clear description of the vulnerability and its impact.
- Step-by-step instructions to reproduce, including any proof-of-concept code, screenshots, or videos.
- The affected URL, endpoint, or product and version where applicable.
- Your contact details if you would like to receive updates and be credited.
Scope
In scope
- Kyvvu’s public website and marketing domains.
- The Kyvvu SaaS control plane and its public APIs.
- The Kyvvu policy-execution components where they are operated by Kyvvu.
Out of scope
- Third-party services and SaaS products that Kyvvu uses but does not operate — report those to the respective vendor.
- Customer-operated edge deployments and customer environments. Do not test these without the customer’s explicit prior consent.
- Social engineering of Kyvvu staff, contractors, or customers; physical attacks.
- Denial-of-service (DoS/DDoS) testing and automated scanning that generates excessive traffic.
- Findings limited to missing best-practice headers or configuration with no demonstrable, exploitable impact.
Legal posture and safe harbor
Kyvvu will not pursue legal action against researchers who report vulnerabilities in good faith, stay within the scope of this policy, do not access or modify data beyond what is needed to demonstrate the issue, and respect the disclosure timeline below. We consider testing conducted consistently with this policy to be authorized, and we will work with you to understand and resolve the issue quickly.
This safe harbor does not extend to actions that violate applicable law or that affect data or systems of Kyvvu’s customers or third parties.
Terms and conditions
- Do not publicly disclose the vulnerability until Kyvvu has had a reasonable opportunity to investigate and remediate — typically 90 days from the date of the report.
- Do not access, modify, exfiltrate, or destroy data belonging to Kyvvu or its customers.
- Do not perform testing that disrupts the service for other users: no DoS, no high-rate automated scanning that affects performance.
- Do not test customer environments or customer-operated edge deployments without the customer’s explicit prior consent.
- Reports must be submitted in English and contain enough detail to reproduce the issue.
What you can expect from us
- An acknowledgement of your report within 5 working days.
- An assessment and a target remediation timeline within 10 working days.
- Status updates as we investigate and fix the issue.
- Public credit on our security acknowledgements page if you wish, subject to your preference.
Kyvvu does not currently operate a paid bug bounty program. We do not offer monetary rewards, but we are grateful for your contribution and will gladly credit you.
Acceptance criteria and prioritization
Valid reports are triaged and prioritized by the Security & Compliance Engineer using a Low / Medium / High / Critical severity scheme based on exploitability and impact to confidentiality, integrity, and availability.
Reports that are typically rejected include: theoretical issues without demonstrable practical impact; missing best-practice headers without a working exploit; findings against out-of-scope or third-party systems; and reports of vulnerabilities already known to us.