SecurityDisclosure program
Found something?
Tell us. We'll fix it and credit you.
We're a security company, so we expect to be tested. If you've found a vulnerability in anything Convoy runs, we want to hear about it, and we won't pursue researchers who follow the rules on this page.
The policy
Scope, rules and what to expect.
In scope
*.convoy.security*.convoysecurity.com*.convoysecurity.net- The Convoy platform, its REST API and MCP server, served from those domains
- Convoy Agent
Out of scope
- Customer environments and customer data, even when monitored by Convoy
- Denial of service, spam and social engineering of staff or customers
- Physical infrastructure
- Findings from automated scanners with no demonstrated impact
How to report
- Email security@convoy.security with steps to reproduce and the impact you observed
- Stop as soon as you've shown the issue exists. Don't read, change or delete data that isn't yours
- Give us a reasonable window to fix it before you publish
What to expect
- Acknowledgment within 2 business days
- A named contact and status updates until it's resolved
- Credit here, with your permission, once it's fixed
- Compensation based on the severity and impact of the finding
- Safe harbor: good-faith research under these rules won't be met with legal action from Convoy
We hold ourselves to the standard we sell.
Uptime, tenant isolation, permissions and audit commitments are written into our contracts. See every commitment →