Vulnerability Disclosure

We welcome good-faith security research that helps protect Shivo users and the specs they keep with us. This policy explains what is in scope, how to report a finding, and what we ask researchers to avoid while testing.

If you follow this policy, make a good-faith effort to avoid privacy violations, and do not disrupt the Service, we will not initiate legal action against you for the research described in your report.

• The Shivo web application at shivo.jishulabs.com
• Authentication, authorization and account isolation issues
• Exposure of secrets, customer data or spec content
• Server-side request handling, API validation and data access control issues
• Cross-site scripting, cross-site request forgery and injection vulnerabilities

• Denial-of-service testing, load testing or resource exhaustion
• Social engineering, phishing or physical attacks
• Reports based only on missing security headers without a practical exploit
• Automated scanner output without analysis or a reproducible impact path
• Issues in third-party services that do not affect Shivo directly

Email reports to admin@jishulabs.com, or send them through the contact page with the bug or security report topic. Include enough detail for us to reproduce and triage the issue.

• Affected URL, endpoint or feature
• Steps to reproduce, a proof of concept and the expected impact
• The account email used for testing, if any
• Any logs, screenshots or timestamps that help confirm the issue

We aim to acknowledge valid reports, triage them by severity, and share meaningful updates as remediation progresses. Public disclosure should wait until we have validated and fixed the issue, unless we agree otherwise in writing.