Responsible Disclosure

We value the work of security researchers and the broader community in keeping Fininvo and our customers safe. If you discover a vulnerability, we ask you to report it to us privately so we can fix it before it is disclosed publicly. We commit to responding quickly, keeping you informed, and never taking legal action against good-faith research conducted under this policy.

Email security@fininvo.com with a clear description of the issue, the steps to reproduce it, the affected URL or feature, the potential impact as you understand it, and any supporting evidence (requests, responses, screenshots). This address is also published in our /.well-known/security.txt file. If the report contains sensitive proof-of-concept data, say so and we will arrange a secure channel.

• In scope: fininvo.com and its subdomains, the Fininvo web applications (ERP, HRMS, Payroll, Jobs, Recruit, partner and admin portals), the public APIs, and the Fininvo mobile apps.
• Priority interest: authentication and session flaws, tenant isolation breaks (accessing another organisation's data), privilege escalation, injection, payment flow issues, and exposure of personal data.
• Not in scope: third-party services we do not control (payment gateways, cloud providers, app stores), social engineering of our staff or customers, and physical attacks.

The following are generally not accepted unless you demonstrate a concrete exploit path:

• Denial-of-service, brute-force or rate-limit findings that require volumetric attack traffic.
• Missing security headers, cookie flags or best-practice observations without demonstrated impact.
• Clickjacking on pages with no sensitive state-changing action.
• Self-XSS, or issues requiring an already-compromised device or browser.
• Version banners, verbose errors or stack traces without exploitability.
• SPF/DKIM/DMARC configuration observations without a demonstrated spoofing path.
• Reports from automated scanners without validation.

• Do not access, modify or delete data that does not belong to you. If you encounter another customer's data, stop, capture the minimum evidence needed, and report immediately.
• Use only test accounts and your own data where possible.
• Do not run denial-of-service tests or bulk automated scans that degrade the service.
• Do not exploit the issue beyond what is necessary to demonstrate it, and do not pivot to internal systems.
• Do not retain, share or publish personal data encountered during research; delete it once the report is confirmed.
• Give us reasonable time to remediate before any public disclosure (Section 7).

We support coordinated disclosure: once a fix is deployed and verified, we are happy to agree a public disclosure date with you, normally no earlier than 90 days from your report or 30 days after the fix, whichever comes first. Please do not disclose before an agreed date; if we are unresponsive past our SLAs, a reminder to security@fininvo.com referencing this policy will escalate the report.

We do not currently operate a paid bug bounty programme. With your permission, we credit meaningful reports with a public acknowledgement, and we may offer discretionary thanks for exceptional findings. If we launch a paid programme, it will be announced on this page.