Vulnerability Disclosure Program

Help us keep Narvar secure by responsibly reporting security vulnerabilities

Report a Vulnerability

Program Overview

Thank you for helping us uphold the highest standards of security.

We continuously work to protect our systems and users, but we understand that no system is flawless. We appreciate responsible disclosure and the collaboration of security researchers worldwide who help us identify and address potential vulnerabilities, strengthening Narvar's overall security posture.

Reporting Security Vulnerabilities

If you have discovered a potential security vulnerability, we encourage you to report it to us promptly. We take all reports seriously and will investigate and address any valid findings.

Program Scope

🎯 Targets In Scope

  • corp.narvar.com
  • *.narvar.com
  • Narvar Web Applications
  • Narvar APIs
  • Narvar Infrastructure and Cloud Services

Note on third-party subdomains: For subdomains delegated to third-party platforms (e.g., support portals, email services, marketing tools), only vulnerabilities arising from Narvar's configuration, integration, or DNS ownership (e.g., subdomain takeover) are in scope. Bugs intrinsic to the vendor's product should be reported to the respective vendor.

In-Scope Vulnerabilities

The following security vulnerabilities found on the Narvar platform are in scope:

  • Remote Code Execution
  • Significant Authentication Bypass
  • Significant Authorization Bypass
  • Cross Instance Privilege Escalation
  • Server Side Request Forgery (SSRF)
  • Insecure Direct Object Reference (IDOR)
  • Injection (SQL, NoSQL, LDAP, etc.)
  • Cross-Site Scripting (XSS) (excluding self-XSS)
  • Cross-Site Request Forgery (CSRF) on critical actions
  • Insecure/Open Redirect (which allows stealing secrets/tokens)
  • (Sub)domain hijacking or DNS Hijacking
  • Findings that reveal valid and bulk sensitive data of our customers and staff

🚫 Targets Out of Scope

  • All sandbox and staging environments
  • All external services/software not managed or controlled by Narvar
  • Third-party software or services
  • Social engineering attacks
  • Physical security issues

Out of Scope Vulnerabilities

  • Missing HTTP security headers (e.g., X-Frame-Options, X-XSS-Protection, Opener Policies)
  • SSL/TLS issues (e.g., BEAST, BREACH, weak/insecure cipher suites)
  • Descriptive error messages (e.g., stack traces, application or server errors)
  • Spamming (e.g., SMS/Email Bombing)
  • HTTP 404 codes/pages or other HTTP non-200 codes/pages
  • Fingerprinting/banner disclosure on public services
  • MITM attacks – traffic interception-based attacks are out of scope
  • Disclosure of known public files or directories (e.g., robots.txt, readme.txt)
  • CSRF on forms available to anonymous users (e.g., the contact form)
  • Login-Logout cross-site request forgery
  • Presence of application or browser 'autocomplete' or 'save password' functionality
  • Lack of Secure and HTTPOnly cookie flags
  • OPTIONS/TRACE HTTP method enabled
  • HTTPS Mixed Content Scripts
  • Vulnerabilities that require installation of software on the victim's device
  • (Distributed) Denial of Service attacks
  • Vulnerabilities requiring physical device access or root/jailbroken devices
  • SSL Pinning bypass and bypassing root/jailbroken detection
  • Any language, grammar, technical inaccuracy, or UI/UX issues
  • Expired domains, SSL/TLS certificates, or leakage via Certificate Transparency Logs
  • Unclaimed social media accounts
  • Reports of keys/tokens in JS without proven exploitability
  • Use of known-vulnerable libraries or frameworks
  • Vulnerabilities affecting outdated/unpatched browsers
  • Subdomain takeover issues without valid proof of concept
  • Known CVE vulnerabilities without proof of exploitability
  • Bugs already classified as ineligible
  • Rate limiting or IP-based rate limiting (unless it implies a severe threat)
  • Social Engineering / Phishing attacks
  • Vulnerabilities native to third-party platforms hosted on Narvar subdomains (the bug must be in Narvar's configuration or integration, not in the vendor's product itself)

Response Timeline

⏰ Our Commitment

  • Initial Response: Within 24 hours of report submission
  • Validation: Within 3-5 business days
  • Resolution: Based on severity and complexity
  • Updates: Regular communication throughout the process

Guidelines and Terms

Program Guidelines

To ensure a successful vulnerability disclosure program, please adhere to the following guidelines:

  • Do not violate user privacy, destroy data, or disrupt Narvar services
  • Do not disclose or share any reported vulnerabilities before resolution
  • Only target systems and assets within the defined scope
  • Provide clear and detailed reports, including steps to reproduce the vulnerability
  • Respect user privacy and confidentiality
  • Testing must not degrade the availability, reliability, or integrity of Narvar services. Denial-of-service (DoS/DDoS), automated scanning that generates excessive traffic, brute-force attempts, and spam/bombing attacks are strictly prohibited

Eligibility and Participation

  • All researchers must agree to Narvar terms and conditions for participating in the Program
  • Narvar employees, contractors, and their families are not eligible for rewards
  • Only the first valid report of a given issue is eligible. Reports are ineligible if (a) Narvar had already identified the issue internally, or (b) another external researcher had already reported the same issue
  • If the issue reported is already identified by Narvar and is in the process of resolving, then such issue shall not be eligible for reward
  • Eligibility for rewards and determination of the recipients and amount of reward is left up to the discretion of Narvar
  • If a researcher inadvertently accesses proprietary customer, employee, or business related information during testing, the information will be contractually restricted from being used, disclosed, stored, or recorded in any way
  • Inadvertent access of the data must be declared within your submission

Legal Considerations

While we appreciate your participation, it is essential to respect and comply with all applicable laws and regulations. We will not take any legal action against security researchers who act responsibly and in good faith during their participation in the vulnerability disclosure program.

However, any unauthorized actions or attempts to exploit vulnerabilities beyond the defined scope will be handled according to the law.

Note: Submissions are only eligible for validation when submitted through our official vulnerability disclosure platform. Any submissions via email or alternative communication sources will not be considered.

VDP Program Clarification: This is a Vulnerability Disclosure Program (VDP) built on the principles of responsible and coordinated security research. Every valid submission is reviewed by our security team, and researchers who help strengthen our security posture are recognized in our Hall of Fame.

For exceptional findings, where a vulnerability is assessed as critical in severity and carries a realistic likelihood of exploitation, we may, at our sole discretion, extend additional forms of appreciation. Such decisions are made case by case, based on the impact, quality of the report, and adherence to our disclosure guidelines.