VULNERABILITY HANDLING AND DISCLOSURE POLICY — M365 Access Audit
We treat the security of our software as a priority. If you have found a vulnerability in M365 Access Audit, the portal (arvetio.com), the panel (panel.arvetio.com) or in our backend (api.arvetio.com), please report it responsibly in accordance with the following rules.
1. HOW TO REPORT
E-mail: security@arvetio.com (subject: "Vulnerability report"). Please provide a description of the vulnerability, the steps to reproduce (proof-of-concept), the version/component, the potential impact and your contact details. Where possible, encrypt sensitive details. We acknowledge receipt of a report without undue delay.
2. OUR COMMITMENTS (COORDINATED DISCLOSURE)
- Acknowledgement of receipt of a report: within 3 business days.
- Initial assessment and triage: within 10 business days.
- Remediation of a confirmed vulnerability: as quickly as possible, commensurate with the risk; we do not release new versions of the product knowing that vulnerabilities remain unremediated.
- We inform the reporter of progress and agree the date of public disclosure (by default within 90 days of the report or after a fix is made available — whichever occurs first).
- With the reporter's consent, we will acknowledge their contribution in the fix notice (credit).
3. SAFE HARBOUR
Good-faith actions consistent with this policy are treated as authorised security research and we will not pursue any claims arising from them. Please: do not violate the privacy of others, do not destroy data, do not disrupt services (no DoS), and test only on your own resources/accounts.
4. SCOPE
In scope: the M365 Access Audit desktop application, arvetio.com, panel.arvetio.com, api.arvetio.com.
Out of scope: third-party services (Microsoft 365, Azure, Cloudflare, PayPal) — report those to the
relevant providers.
5. NO BUG BOUNTY PROGRAMME
We do not run a paid rewards programme. We do, however, appreciate responsible reports and are glad to give public thanks (with the reporter's consent).
6. LEGAL CONTEXT (CRA)
As a software manufacturer we monitor vulnerabilities throughout the product's support period and — in accordance with Regulation (EU) 2024/2847 (Cyber Resilience Act) — we report actively exploited vulnerabilities and serious incidents to the competent authorities (the ENISA / CSIRT platform). Weinform users of significant vulnerabilities and available fixes.
Contact: security@arvetio.com. See also: /.well-known/security.txt.
Effective date: 15.08.2026.