Vulnerability Disclosure

This page explains how to report a security vulnerability in Kivvo. If you've found a security issue, we want to hear from you — and we want to make it safe and straightforward to tell us.

The short version

If you've found a security vulnerability in Kivvo, please report it. We take security reports seriously.

Report via a support ticket on the Support page, or via security@kivvo.co.nz for sensitive reports.

Give us a reasonable chance to fix the issue before you disclose it publicly.

We won't take legal action against good-faith security researchers who follow this policy.

We aim to acknowledge reports within 2 business days and provide an initial assessment within 7 business days.

We don't currently run a paid bug bounty program, but we recognise good-faith researchers in our security acknowledgements page (with your permission).

Our commitment

Kivvo handles financial information, so security is core to what we do. We welcome reports from security researchers, and we're committed to working with you to fix issues quickly and fairly.

We're a small New Zealand company — currently two people. That shapes how we respond: our timelines are honest, our processes are direct, and we won't pretend to have resources we don't.

What counts as a vulnerability

A security vulnerability is a weakness in Kivvo's systems, application, or infrastructure that could:

Allow unauthorised access to an account

Allow unauthorised access to data

Allow unauthorised actions to be taken

Compromise the confidentiality, integrity, or availability of our systems

Result in financial loss to users or to Kivvo

Examples include (but aren't limited to):

Authentication bypass

Authorisation flaws (for example, accessing another user's data)

Injection vulnerabilities (SQL, command, template, etc.)

Cross-site scripting (XSS)

Cross-site request forgery (CSRF)

Server-side request forgery (SSRF)

Insecure direct object references (IDOR)

Sensitive data exposure

Weak cryptography

Business logic flaws that could be exploited for gain

Payment bypass or manipulation

If you're not sure whether something counts, report it anyway. We'd rather assess a non-issue than miss a real one.

What is not covered by this policy

The following are out of scope and shouldn't be reported through this process:

Third-party services. Stripe, Supabase, Vercel, Render, and other services we use have their own vulnerability disclosure programs. Report issues in their products directly to them.

Social engineering against Kivvo staff or users. Please don't attempt to phish, deceive, or social-engineer anyone at Kivvo. That's not good-faith testing.

Physical attacks against Kivvo infrastructure or personnel.

Denial-of-service (DoS) or stress testing. Please don't run these against Kivvo.

Automated scanning that generates excessive traffic. Please don't scan in ways that could affect service.

Theoretical vulnerabilities without demonstrated impact.

Self-XSS (cross-site scripting that requires the victim to paste code themselves).

Clickjacking on non-sensitive pages.

Missing security headers that don't have a demonstrated impact.

Outdated software versions without a demonstrated exploit path.

Email configuration issues (SPF, DKIM, DMARC) unless they enable a specific attack.

Subdomain takeover of non-production infrastructure.

If you're unsure whether something is in scope, ask first via a support ticket.

How to report

For most reports

Submit a support ticket via the Support page, and choose the closest category. Include the details listed below.

Please do not publicly disclose the vulnerability before we've had a reasonable chance to fix it.

For sensitive reports

If your report involves sensitive information — for example, a demonstration exploit that could be misused — please email security@kivvo.co.nz instead.

This is the one place we use email, and only for security reports. All other support and communication goes through support tickets.

What to include

To help us assess and fix the issue quickly, please include:

A clear description of the vulnerability

The affected component — for example, a specific page, endpoint, or feature

Steps to reproduce — the minimum steps needed for us to see the issue

Proof of concept — if applicable, a demonstration that the vulnerability exists

Impact — what an attacker could do if they exploited it

Your contact details — how we can reach you if we need to ask follow-up questions

Whether you'd like to be acknowledged — we're happy to credit you if you'd like

If you need to include sensitive information, email it to security@kivvo.co.nz.

Our commitment to you

If you report a vulnerability in good faith and follow this policy, we commit to:

Not take legal action against you for researching or reporting the vulnerability

Not report you to law enforcement for the act of researching or reporting

Work with you to understand and fix the issue

Acknowledge your report promptly

Keep you informed of our progress

Credit you in our security acknowledgements (with your permission)

We consider security research and vulnerability disclosure to be legitimate activity when done in good faith and in accordance with this policy.

What we ask of you

To keep this process fair and to maintain our commitment not to take legal action, we ask that you:

Act in good faith. Only report genuine vulnerabilities, not fabricated or theoretical issues.

Don't access, modify, or delete user data. If you accidentally access data that isn't yours, stop immediately, don't save it, don't share it, and tell us.

Don't disrupt the service. Don't run denial-of-service, don't attempt to overload systems, and don't interfere with other users' accounts.

Give us time to fix it. Please give us a reasonable period — typically 90 days — before publicly disclosing the issue.

Don't extort us. Don't demand payment in exchange for not disclosing a vulnerability.

Follow the law. Don't do anything that would be illegal in New Zealand.

Keep the report confidential until we've fixed the issue.

If you breach any of these conditions, our commitment not to take legal action doesn't apply.

What happens after you report

Here's the process we follow:

1. Acknowledgement (within 2 business days)

We'll acknowledge your report and confirm we've received it. We'll also give you a point of contact.

2. Initial assessment (within 7 business days)

We'll assess the report and let you know:

Whether we consider it a genuine vulnerability

Its severity (based on our internal severity framework)

Our initial plan and expected timeframe

3. Investigation and fix

We'll investigate the issue, develop a fix, and test it. Depending on severity, this might take days, weeks, or longer.

We'll keep you updated on progress.

4. Deployment

When the fix is ready, we'll deploy it to production. Depending on the issue, this might be a same-day deployment for critical issues, or a scheduled deployment for less urgent ones.

5. Notification and disclosure

Once the fix is deployed and any affected users have been notified, we'll be happy for you to disclose the issue publicly. We'll coordinate with you on timing.

6. Acknowledgement

With your permission, we'll add your name (or handle) to our security acknowledgements page.

Response timelines

We aim to meet these timelines:

Because we're a very small team, these timelines are aims, not guarantees. If we miss them, we'll tell you why and give a revised estimate.

No bug bounty program

Kivvo does not currently run a paid bug bounty program. We're a small company, and we can't offer financial rewards for vulnerability reports.

We do offer:

Acknowledgement on our security acknowledgements page (with your permission)

Direct interaction with the people who build and maintain Kivvo

A genuine commitment to fix issues promptly

Good-faith protection in the form of our commitment not to take legal action

If we launch a bug bounty program in the future, we'll update this page.

Coordinated disclosure

We support coordinated disclosure. This means:

You report the vulnerability to us

We confirm, investigate, and fix it

We agree with you on a timeline for public disclosure

You publish your findings (with credit) once the fix is deployed

We typically ask for a 90-day disclosure window from the date of report. For critical issues, we may ask for a shorter window (so we can fix it faster). For complex issues, we may ask for a longer window.

We'll work with you on a timeline that's fair to both of us.

What happens with your information

When you report a vulnerability:

We'll handle your report confidentially.

We may need to share details with our service providers (such as Supabase or Vercel) to investigate or fix the issue.

We may need to share details with law enforcement where we're legally required to.

Otherwise, we won't share your report or your identity without your consent.

We handle personal information in accordance with our Privacy Policy.

Acknowledgements

We're grateful to the security researchers who help keep Kivvo secure. With their permission, we recognise good-faith reporters on our security acknowledgements page.

If you'd like to be acknowledged, tell us when you report. If you'd prefer to remain anonymous, that's completely fine too.

Where to find more detail

For more information, see:

Report Fraud — how to report suspected fraud on your own account

Privacy Policy — how we handle personal information

Terms of Service — the general agreement between you and Kivvo

Acceptable Use Policy — what you can and can't do on Kivvo

If you have a security question that isn't a vulnerability report, please submit a support ticket via the Support page.

If you have a vulnerability to report, use security@kivvo.co.nz.

This page was last reviewed in October 2026.