Report a Security Issue

Before you submit

Please review our Vulnerability Disclosure Policy to confirm the issue is in scope and to understand our safe-harbor commitments.

Submit by email (preferred)

Send your report directly to security@navica.ai. If your report contains highly sensitive details, encrypt with our PGP key (when published at /.well-known/pgp-key.asc).

Use subject line [security] <short summary>. Prefix with [urgent] if the issue is actively being exploited.

What to include

A useful report includes:

1. Summary — one paragraph describing the issue and its potential impact.
2. Affected component — URL, product, version, or commit reference.
3. Steps to reproduce — clear, minimal steps including any test accounts or payloads.
4. Impact assessment — what an attacker could do.
5. Proof-of-concept — code, screenshots, or recording.
6. Suggested remediation (optional).
7. Credit preference — pseudonym, real name, employer, or anonymous.
8. Your contact details for follow-up.

What happens next

• We acknowledge receipt within 5 business days.
• We share an initial triage outcome within 5 business days of acknowledgment.
• We provide status updates at least every 30 days during investigation.
• We coordinate disclosure on a default 90-day embargo, with public credit (with your consent).

Other channels

• Machine-readable contact: /.well-known/security.txt (RFC 9116)
• Postal: Navica AI Ltd., Riverside One, Sir John Rogerson's Quay, Dublin 2, D02 X576, Ireland — attn. Security
• Privacy / data protection: dpo@navica.ai — not for security vulnerabilities