Security policy

Found a vulnerability in CVE Hive itself? We'd love to hear about it.

How to report

Email me@projectcnx.in with:

• what you found and where (URL / feature),
• steps to reproduce,
• the impact you believe it has.

We aim to acknowledge reports within 3 working days and to keep you updated until it's fixed.

Please

• Give us reasonable time to fix the issue before disclosing it publicly.
• Only test against your own account. Don't access, change or delete other people's data.
• No denial-of-service, spam, social engineering or physical attacks.
• Don't use automated scanners at a rate that disrupts the service.

In scope

• hive.projectcnx.in and its sign-in, submission and review flows

Out of scope

• Third-party services we use (Supabase, Vercel, GitHub, Cloudflare): report those to them directly.
• Missing best-practice headers with no demonstrated impact, self-XSS, or reports from automated tools without a working proof of impact.

We don't run a paid bug bounty yet, but we're happy to credit you here (with your permission).

Machine-readable contact: /.well-known/security.txt