Responsible Disclosure

Last updated: 4 November 2026

How to report

Email provelex@devsapience.com with "Security vulnerability" in the subject. Our contact details are also published at /.well-known/security.txt. Please include:

• What the problem is, and where you found it.
• Steps to reproduce it, or a small proof of concept.
• What you think an attacker could do with it.
• How to contact you, and the name you would like us to use if you wish to be thanked.

In scope

The provelex.com website and its application, using an account you created yourself.

Out of scope

• Websites that people have tested with Provelex. They belong to their owners.
• Third-party services we use, such as Dodo Payments, Google or our email provider. Please report to them directly.
• Other DevSapience products and other services on the same server.
• Reports with no demonstrated impact, such as a missing header or the output of an automated scanner on its own.

The rules for testing

• Only access your own account and data. If you come across someone else's, stop, do not keep a copy and tell us.
• Do not run denial-of-service attacks, high-volume automated scans or anything that could degrade the service.
• Do not use phishing or social engineering, or attack our staff, offices or providers.
• Do not change or delete data that is not yours, and do not leave anything behind that could harm others.
• Give us reasonable time to fix a problem before telling anyone else about it.

What you can expect from us

• We will read every report and let you know we have received it.
• We will tell you what we find and when the problem has been fixed.
• We will not take legal action against research carried out in good faith under these rules.
• We will thank you publicly if you would like, once the problem is fixed.

We do not currently run a paid bug bounty programme.

Questions

DevSapience Technology Solutions publishes Provelex. Write to provelex@devsapience.com with any question about this page.