Security at SkiveCore

Responsible Disclosure Policy

If you believe you've discovered a security vulnerability in a SkiveCore service, we encourage you to report it to us responsibly. Please follow these guidelines:

Scope

This policy applies to security vulnerabilities found within the following SkiveCore assets:

• The primary website: `skivecore.com` (and its subdomains)
• Official SkiveCore mobile applications (iOS and Android)
• APIs directly supporting the website and mobile applications

Out of Scope:

• Third-party services or vendors used by SkiveCore (please report issues directly to the vendor).
• Findings from physical testing (e.g., office access).
• Social engineering (e.g., phishing, vishing) of SkiveCore staff or users.
• Denial of Service (DoS or DDoS) attacks or activities that could degrade service for users.
• Scanner output or purely theoretical vulnerabilities without proof-of-concept.
• Issues related to missing security headers/configurations (e.g., missing HSTS, weak TLS ciphers) unless they demonstrate a direct, exploitable impact.
• Self-XSS or issues exploitable only through unlikely user interaction.

How to Report

Please email your findings directly to our security team:

security@skivecore.com

In your report, please include as much detail as possible:

• A clear description of the vulnerability and its potential impact.
• Detailed steps to reproduce the issue, including any specific URLs, parameters, or account types needed.
• Proof-of-concept code, screenshots, or videos are highly encouraged.
• Any suggestions for remediation, if you have them.

Please allow our team reasonable time to investigate and respond before publicly disclosing any findings.

Rules of Engagement

When researching, please:

• Do No Harm: Avoid actions that could impact the availability or integrity of our services or user data (e.g., no DoS, data deletion/modification).
• Respect Privacy: Do not access, download, or modify data belonging to other users. Limit testing to accounts you own.
• Act in Good Faith: Do not engage in extortion or demand payment in exchange for vulnerability details outside of any stated bug bounty program (see below).
• Comply with all applicable laws and regulations.

Safe Harbor

SkiveCore considers security research conducted under this policy to be authorized and lawful. We will not pursue civil or criminal legal action, nor initiate a law enforcement investigation, against researchers for vulnerability testing activities that adhere to this policy. If legal action is initiated by a third party against you concerning activities conducted in accordance with this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.