Traducción automática. Si hay alguna diferencia, prevalece la versión en inglés.
En esta página
Security and vulnerability disclosure
In short
- If you find a security problem in MovItaly, please tell us at Por confirmar. We want to hear about it and we will not treat good-faith research as an attack.
- Do not read, change or keep other people's data, and do not disturb the service. Stop as soon as you see you could reach personal data, and tell us.
- We do not run a paid bug bounty. We will thank you and, with your permission, credit you.
- If you are a user with a privacy question rather than a vulnerability, write to Por confirmar instead.
1. How we protect the service
Data is hosted in the European Union and encrypted in transit and at rest. Uploaded documents sit in a private bucket encrypted with a key we manage. Passwords are hashed, two-factor sign-in is available, access for our staff is limited by role and logged, and sign-in sessions can be revoked. We keep audit logs, update dependencies and plan to review our setup regularly. No system is perfectly safe, which is why we welcome reports from researchers. How we handle personal data is explained in the privacy policy.
2. What is in scope
In scope: the website at movitaly.ai, the web app, the iOS and Android apps, and our public API. Examples of problems we want to hear about: access to another person's account or data, bypassing sign-in or payment, injection or script flaws, exposed secrets or storage, weaknesses in how documents are stored, and ways to make the AI companion reveal other users' data.
Out of scope: denial-of-service or load testing, spam or social engineering of our staff or users, physical attacks, findings in third-party services we use (report those to the provider, such as Stripe, Apple or Google), missing best-practice headers with no real impact, and automated scanner output without a working example.
3. How to report
Write to Por confirmar. Please include what you found, the steps to reproduce it, the address or screen where it happens, and what you think the impact is. Use a test account you created yourself, and never test with a real user's data. If you need to send sensitive details, ask us for an encrypted channel first. You may write in English or Italian.
4. What we will do
We aim to confirm that we received your report within 5 working days, to keep you informed while we investigate, and to fix valid problems according to their seriousness. [OWNER: confirm these targets.] If a problem affects personal data, we follow our breach procedure and notify the authority and the people concerned when the law requires. With your permission, we credit you once the fix is live. Please give us a reasonable time to fix a problem before you tell anyone else.
5. Safe harbour
If you act in good faith and follow this page, we will not start legal action against you for your research and will not report you to the authorities because of it. Good faith means you stay within the scope above, avoid privacy harm, do not read, copy, change or delete data that is not yours beyond what is needed to show the problem, do not disrupt the service and give us a chance to fix it before disclosure. This promise covers us only. We cannot speak for third parties or for authorities, and it does not allow anything that is illegal for reasons other than your research. [OWNER and counsel: confirm this wording.]
6. Contact
Security reports go to Por confirmar. Privacy requests go to Por confirmar. The company is Lodato Solutions LLC, Por confirmar. When the security mailbox is live, we will also publish it in a standard security.txt file on our website, so that researchers and automated tools can find the right address without searching for it.