Version: 1.0 Last Updated: September 2026

1. Scope

This policy applies to security vulnerabilities discovered in:

Nova IAM application code (backend and frontend)
Nova IAM deployment configurations
Nova IAM documentation that could lead to insecure deployments

2. Reporting a Vulnerability

How to Report

Email: security@nova-iam.com
Subject line: [VULN] Brief description
Contact details (RFC 9116): https://www.nova-iam.com/.well-known/security.txt

What to Include

Description of the vulnerability
Steps to reproduce
Potential impact assessment
Suggested fix (if available)
Your contact information for follow-up

What NOT to Do

Do not publicly disclose the vulnerability before it is resolved
Do not access, modify, or delete data belonging to other users
Do not perform denial-of-service attacks
Do not use social engineering against Nova IAM staff or customers

3. Our Commitment

Action	Timeline
Acknowledge receipt	Within 2 business days
Initial assessment	Within 5 business days
Status update	Every 7 days until resolution
Fix deployed	Based on severity (see below)
Public advisory	After fix is deployed and customers are notified

Fix Timelines by Severity

Severity	Fix Timeline
Critical (RCE, auth bypass, data breach)	48 hours
High (privilege escalation, injection)	7 days
Medium (information disclosure, CSRF)	30 days
Low (best practice improvements)	Next release

4. Recognition

For researchers who report vulnerabilities to us:

Researchers are credited in security advisories (unless they prefer anonymity)
We do not pursue legal action against researchers acting in good faith under this policy

5. Safe Harbor

Any activities conducted in a manner consistent with this policy will be considered authorized. We will not initiate legal action against researchers who:

Act in good faith
Avoid privacy violations and data destruction
Report findings promptly
Allow reasonable time for remediation before disclosure

Vulnerability Disclosure Policy