Report a Security Issue

If you've found a security vulnerability affecting crenvu.com, we want to hear from you. We take all legitimate reports seriously and are committed to working with the security research community to identify and resolve issues responsibly.

If you follow these principles when researching and reporting a security issue, we will not pursue legal action against you for your report:

• Give us reasonable time to investigate and fix an issue before disclosing it publicly or to others.
• Act in good faith — avoid privacy violations, service disruption, or destruction of data.
• Only test against your own account. Do not access, modify, or attempt to access another customer's account or data.
• Do not exploit the issue beyond what's needed to demonstrate the vulnerability.
• Comply with all applicable laws throughout your research and disclosure process.

Send your report directly to our team at Contact@crenvu.com with the subject line "Security Report." Please do not disclose the issue publicly or on social media before we've had a reasonable opportunity to investigate and address it.

To help us investigate quickly, please include as much of the following as possible:

• A clear description of the vulnerability and its potential impact
• Step-by-step instructions to reproduce the issue
• Screenshots, screen recordings, or proof-of-concept code, where relevant
• The URL, endpoint, or feature affected
• Any tools or browser/device details used during testing

We offer bounties to researchers who report valid, in-scope vulnerabilities, awarded at Crenvu LLC's discretion based on severity and impact. The first valid report of a given issue receives the bounty, and detailed, fully reproducible reports are required to qualify.

The following are generally not considered actionable security reports:

To submit a report or ask a question about this policy, reach out below.