Scope
In scope
- getnovaplan.com and all subdomains
- Novaplan web application (authenticated and unauthenticated surfaces)
- Novaplan API endpoints
- Authentication and authorization controls
- Data access and tenant isolation
Out of scope
- Denial of service attacks
- Social engineering of Novaplan staff or customers
- Physical attacks
- Vulnerabilities in third-party services we rely on (report those to the vendor directly)
- Automated scanning that generates excessive load on production systems
How to report
Email security@getnovaplan.com with:
- A description of the vulnerability and its potential impact
- Steps to reproduce (include screenshots or a proof-of-concept if possible)
- The URL, parameter, or component affected
- Your contact details for follow-up
Please do not include sensitive customer data in your report. If you believe you have accessed data you should not have, stop and report it immediately.
Response timelines
| Step | Timeline |
|---|---|
| Acknowledgment of your report | Within 24 hours |
| Initial severity assessment | Within 3 business days |
| Resolution - Critical severity | 7 days |
| Resolution - High severity | 30 days |
| Resolution - Medium severity | 90 days |
We will keep you informed of our progress and will credit you in our release notes if you choose.
Safe harbor
We will not pursue legal action against researchers who:
- Report in good faith using the channel above
- Do not access, modify, or exfiltrate customer data beyond what is necessary to demonstrate the vulnerability
- Do not disclose the vulnerability publicly before we have had a reasonable opportunity to fix it (90 days from acknowledgment, or by mutual agreement)
Responsible disclosure
We ask that you give us the opportunity to fix vulnerabilities before public disclosure. We aim to resolve critical and high severity issues within the timelines above. If we fail to meet those timelines, we will agree to a coordinated disclosure date with you.