Vulnerability Disclosure Policy

Our commitment

Navica AI welcomes security research conducted in good faith on our products, services, and public infrastructure. This policy describes how to report a vulnerability to us, what you can expect in response, and the safe-harbor commitments we provide to good-faith researchers.

If you are an existing Navica customer with a contractual support relationship, please continue using your support channel for confirmed product defects. This policy covers security vulnerabilities and is complementary, not a replacement.

Scope

In scope

Vulnerabilities affecting any of the following:

• The Navica AI public website and any subdomain of navica.ai
• The NavicaAI Platform and supporting services distributed under the Navica brand
• Cryptographic primitives and audit-chain integrity in the Navica signing service
• Container images and other artifacts published by Navica under our official channels
• Navica security mail infrastructure (key handling, SPF/DKIM/DMARC)
• Customer-facing software distributed by Navica (desktop bundles, mobile applications)

Out of scope

The following are not in scope for this VDP — please do not test against them:

• Customer-operated deployments of the NavicaAI Platform — these are the customer's environments and security testing requires the customer's written authorization.
• Third-party providers configured by customers in their deployments (e.g., the customer's chosen LLM, search, weather, or routing provider) — please contact the relevant provider directly.
• Vendor relationships where the issue is in the vendor's product — please use that vendor's own disclosure program.
• Issues that require physical access to a Navica office or device.
• Social engineering of Navica staff, customers, contractors, or partners (including unauthorised phishing simulations).
• Denial-of-service or volumetric attacks.
• Issues already publicly known.
• Findings limited to non-security functionality (please open a normal support ticket).
• Software released to research or experimental channels (clearly labelled as such).

If you are unsure whether something is in scope, contact us first at security@navica.ai.

How to report

Email (preferred)

Send your report to security@navica.ai, ideally PGP-encrypted using our published key (when available). Use subject line [security] <short summary>; prefix with [urgent] for issues being actively exploited.

Web form (alternative)

The intake form at /security/report reaches the same inbox. PGP encryption is not available via the form — please use email for highly sensitive details.

What to include

1. Summary — one paragraph describing the issue and its potential impact
2. Affected component — URL, product, version, or commit reference if known
3. Steps to reproduce — clear, minimal steps including any test accounts or example payloads
4. Impact assessment — your view of what an attacker could do
5. Proof-of-concept — code, screenshots, recordings, or a demonstration of the vulnerability
6. Suggested remediation (optional)
7. How you'd like to be credited — pseudonym, real name, employer, or anonymous
8. Your contact details for follow-up

What you can expect from us

Severity is assessed using CVSS v3.1 and our internal impact analysis. Target remediation timelines:

• Critical: within 7 days of confirmation
• High: within 30 days
• Medium: within 90 days
• Low: scheduled into the next regular release cycle

Safe harbor

We commit to the following for security research conducted in good faith and within the scope and rules of this policy:

1. No legal action. We will not pursue civil or criminal claims, or report you to law enforcement, for security research that stays in scope, does not access or modify data belonging to others, does not degrade availability, respects user privacy, and discloses the issue to us with a reasonable time to remediate before going public.
2. DMCA / TPM exception. We will not rely on technical-protection-measure circumvention laws against good-faith researchers.
3. CFAA & Italian Penal Code Art. 615-ter. We consider good-faith security research within scope to be authorised access and will say so in any subsequent communication. (This commitment is to the maximum extent permitted by law; criminal-law immunity is not within our gift to grant.)
4. Third-party authorisation. We cannot grant safe harbor for testing third-party services even if they appear adjacent to Navica. If your testing might touch a third party, contact us first.

This safe harbor does NOT cover:

• Researchers acting in bad faith (extortion, data exfiltration beyond what's needed to demonstrate the issue, public disclosure before coordinating with us, intentional damage)
• Testing on customer deployments without the customer's explicit written authorisation
• Activity outside the in-scope list above

Coordinated disclosure

We follow coordinated vulnerability disclosure under ISO/IEC 29147:2018. Our default embargo is 90 days from acknowledgment, during which we ask you not to disclose details publicly. We will work with you on joint advisory publication, CVE assignment where applicable, customer notification timing, and credit attribution. If a vulnerability is being actively exploited in the wild, we may shorten the embargo to issue a patch faster — we will tell you if this happens.

What we won't do

• We do not currently operate a bug bounty (no monetary rewards). We are evaluating this for a future programme.
• We do not threaten, retaliate against, or sue good-faith researchers.
• We do not silently fix vulnerabilities. Material security fixes are disclosed in our release notes and, for critical issues, via security advisory.

Prohibited research activities

To stay within scope and safe harbor:

• Do not access, modify, or delete data that is not your own. Use a test account.
• Do not run sustained automated scanners against Navica infrastructure — manual proofs are fine; large-scale brute-force or fuzzing must be discussed first.
• Do not perform denial-of-service or load testing without prior written authorisation.
• Do not social-engineer Navica staff, customers, or partners.
• Do not publicly disclose the issue before our coordinated-disclosure window ends without prior agreement.
• Do not pivot from the initial finding into further compromise — stop at proof-of-concept.

Jurisdictional notes

Navica AI Ltd. is incorporated in Ireland and Navica Italy S.r.l. is incorporated in Italy. This policy is governed by Irish law without prejudice to your local consumer-protection rights. We acknowledge:

• Ireland: Researchers acting in good faith within this policy are not subject to claims under the Criminal Justice (Offences Relating to Information Systems) Act 2017.
• Italy: Researchers acting in good faith within this policy are not subject to claims under Italian Penal Code Article 615-ter (accesso abusivo a un sistema informatico).
• EU NIS2 Directive (2022/2555) and its national transpositions: Navica's incident notification obligations to competent authorities are independent of this VDP.
• EU AI Act (Regulation 2024/1689) Article 73: serious AI-system incidents will be reported by Navica to the appropriate market surveillance authority within statutory timelines.

If you are located in a jurisdiction whose laws conflict with this policy, contact us before testing and we will work with you on an arrangement.

Contact

• Email: security@navica.ai
• Web form: /security/report
• security.txt: /.well-known/security.txt
• Postal: Navica AI Ltd., Riverside One, Sir John Rogerson's Quay, Dublin 2, D02 X576, Ireland — attn. Security

For privacy and data-protection matters, contact dpo@navica.ai instead.