Responsible Disclosure

Write to sales@acervusllc.com with a description of the issue, the affected system or URL, and steps to reproduce it. Do not include sensitive data you may have accessed. Our contact details are also published in security.txt.

Acervus will not pursue legal action against researchers who act in good faith under this policy.

• Test only against Acervus systems, and only as far as needed to demonstrate the issue.
• Do not access, modify, or retain data that is not yours, and do not degrade service.
• Do not use social engineering or physical attacks.
• Give us reasonable time to fix the issue before disclosing it publicly.

This policy covers Acervus's own systems and this website. It does not authorize testing of any client, partner, or third-party system.