Security & Vulnerability Disclosure

1. We want to hear from you

If you discover a security vulnerability in Restivity (the web app, the public REST API, the MCP server, the OAuth flow, or any other surface under restivity.ai), please report it to us. We treat security reports as top-priority work and we respect researchers who follow responsible disclosure.

This page is referenced from /.well-known/security.txt per RFC 9116.

2. How to report

Send an email to:

security@restivity.ai

Include in your report:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce, ideally with curl commands or a minimal proof-of-concept
• The affected URL, endpoint, or component (e.g. /api/v1/tasks)
• Your name or pseudonym for acknowledgement (optional)

Please report in English or Italian. PGP encryption is currently not required. If you need an encrypted channel, ask first and we'll set one up.

3. What you can expect from us

• Acknowledgement within 48 hours. Even if we can't fully triage immediately, you'll get a human reply confirming we received the report.
• Status update within 7 days. We'll tell you whether we accept the report, our preliminary severity assessment, and our planned timeline.
• Fix or mitigation within a target window based on severity:
  • Critical: 7 days or fewer
  • High: 30 days
  • Medium: 60 days
  • Low: 90 days or as part of normal release cadence
• Coordinated disclosure. When we ship the fix, we'll work with you on a public disclosure date. By default we credit reporters in the release notes. Let us know if you prefer to stay anonymous.

4. Safe harbour

If you act in good faith, comply with this policy, and only test against accounts you own or have explicit permission to test, we will not pursue legal action against you, ask law enforcement to investigate you, or terminate your account for the research itself. Specifically:

• You may set up multiple test accounts on Restivity at no cost.
• You may probe the public REST API and MCP server with your own bearer tokens.
• You may use automated scanners only against your own accounts and at a rate that doesn't degrade the service for others.

This safe harbour does not apply if you exfiltrate, modify, or publish other users' data; perform DoS attacks; or use a finding to extort. In those cases standard terms apply and we will pursue all available remedies.

5. In scope

• https://restivity.ai and any subdomain we operate
• The OAuth 2.0 surface: /oauth/*, /api/oauth/*
• The REST API: /api/v1/*
• The MCP server: /api/mcp
• The discovery surface: /.well-known/*, /sitemap.xml
• The web app authentication and session handling
• The browser extension (Chrome / Firefox)

6. Out of scope

• Reports that require physical access to a victim's device or social engineering of Restivity staff
• Vulnerabilities in third-party services we depend on (Supabase, Vercel, Cloudflare, Sentry): please report those to the respective vendors
• Spam, phishing, or content-injection issues that don't cross a security boundary
• Attacks requiring an already-compromised user device (malware, browser extensions the user installed)
• Denial-of-service findings unless they prove a logical bypass
• Missing security headers without a demonstrated exploit (we welcome the heads-up but we don't treat it as a vulnerability)
• Issues already publicly known or already in our backlog

7. Recognition

We don't currently run a paid bug bounty programme. We do publicly acknowledge researchers who report responsibly (with their permission) in the release notes and (when we have one) on a future security acknowledgements page.

8. Questions

For anything that isn't a vulnerability report (clarifications on this policy, scope questions, requests for an encrypted channel), also write to security@restivity.ai. We read it.