Security & Responsible Disclosure

1. Our approach

Revizona is operated by Revizona Ltd. Many of our users are students under 18, so we take the security of their accounts and data seriously. No system is perfectly secure, and we do not claim to be. This page explains the main steps we take and how you can help us by reporting problems responsibly.

2. How we protect data

Encryption in transit. Connections to revizona.com use HTTPS (TLS), so data travelling between your device and our services is encrypted.
Controlled database access. The app does not have open access to our database. Reads and writes go through access rules and controlled server-side functions that check who you are and what you are allowed to see.
Least privilege. Team members and services get only the access they need to do their job.
Separate production access. Access to our live (production) systems is limited to a small number of authorised people and is kept separate from development and testing.
Monitoring. We monitor our services for errors and unusual activity and investigate issues we find.
Keeping software up to date. We update the software libraries and services we depend on regularly, including applying security fixes.
Trusted providers. We use established providers for hosting, authentication and payments. We never store full payment card numbers. See our Privacy Policy for the providers we use and where data is processed.

If we have a personal data breach, we report it to the Information Commissioner’s Office (ICO) within 72 hours where the UK GDPR requires, and tell affected users without undue delay where it is likely to put them at high risk. See our Privacy Policy.

3. Reporting a vulnerability

If you think you have found a security vulnerability in Revizona, please email [email protected]. Our contact details are also published in our security.txt file at /.well-known/security.txt.

Please include:

a description of the issue and its likely impact;
the affected URL, feature or component;
clear steps to reproduce it, with any proof-of-concept code, screenshots or requests;
the date and time you found it;
your name or handle and how you would like to be contacted; and
whether you would like to be credited.

Please do not include other people’s personal data in your report beyond what is strictly needed to show the issue.

4. Our promises to you

We will acknowledge your report within 3 working days.
We will investigate, tell you whether we can confirm the issue, and keep you updated on our progress.
We will let you know when the issue is fixed.
With your permission, we will credit you publicly for your discovery. We will not name you without your agreement.

5. Safe harbour for good-faith research

If you carry out security research in good faith and in line with this policy, we consider that research authorised by us for the purposes of the Computer Misuse Act 1990. We will not take legal action against you or ask the police to investigate you for it. If someone else takes legal action against you for research that followed this policy, we will make it known that your actions were authorised by us. Our authorisation covers only Revizona’s own systems; it does not bind third parties, and you remain responsible for complying with the law.

To stay within this safe harbour, you must:

only access the data you need to demonstrate the issue. Use your own test accounts where possible. If you come across another user’s personal data, stop, do not keep or share it, and tell us straight away;
not change or delete data that is not yours;
not carry out denial-of-service attacks or anything that degrades the service for other users;
not use automated mass scanning or high-volume testing that harms performance or availability;
not use social engineering, such as phishing or impersonation, against our staff, users or providers;
not attempt physical attacks on our offices, equipment or people;
not exploit an issue beyond what is needed to confirm it, or use it for any other purpose;
keep the details confidential until we have fixed the issue, and give us reasonable time before any public disclosure. We ask for 90 days from your report, or sooner if we confirm a fix earlier. If you think a longer or shorter period is needed, talk to us.

6. Out of scope

The following are outside this policy:

the systems of our third-party providers (for example, our hosting, database, payment or email providers). Please report issues in their services to them directly;
findings from automated scanners without a working proof of impact;
missing security headers or best-practice settings with no demonstrated security impact;
clickjacking on pages with no sensitive actions;
self-XSS, or issues that require physical access to a user’s unlocked device;
reports about software versions with no demonstrated exploit;
spam, social engineering or physical security issues;
denial-of-service or rate-limiting issues that can only be shown by degrading the service.

If you are unsure whether something is in scope, email us first.

7. Rewards

We do not currently run a paid bug bounty programme, and submitting a report does not create any right to payment. We are grateful for responsible reports and will credit researchers who want to be named.