​
Reporting a vulnerability

Do not open a public issue for a security vulnerability, and do not disclose it publicly before it is fixed.
Report privately through GitHub private vulnerability reporting: go to the repository’s Security tab and choose Report a vulnerability. This opens a private advisory visible only to maintainers.

​
What to include

  • What the issue is, and which component is affected
  • Steps to reproduce, ideally a minimal proof of concept
  • What an attacker could achieve — data disclosure, privilege escalation, and so on
  • Any suggested remediation

​
What to expect

We will acknowledge your report, investigate, and keep you updated as we work on a fix. Once it is resolved we will coordinate disclosure timing with you, and credit you in the advisory unless you prefer otherwise.

​
Scope

Vulnerabilities in GoConva itself are in scope — the API, the client, the voice worker, and the widget. Out of scope:
  • Vulnerabilities in third-party services GoConva integrates with. Report those to the service.
  • Issues that require an already-compromised host or an already-leaked credential.
  • Missing hardening that is not exploitable on its own.

​
Handling credentials

GoConva stores integration credentials encrypted at rest. When reporting or reproducing an issue, never include real credentials — API keys, OAuth tokens, Twilio auth tokens, or bot tokens — in a report, a screenshot, or a test fixture. If you believe a credential has been exposed, rotate it at the provider immediately and reconnect the integration; see the relevant integration guide for how to reconnect.