How to read this document. It describes how Pinevon and GorZesk are built and operated today. If a sentence is unclear or you think it does not match what you see in the product, write to hello@pinevon.com and we will answer and correct it. Before a material change takes effect we publish the new version here with a new version number and effective date.
1. Our commitment
We welcome reports from security researchers. If you find a vulnerability in a Pinevon service, tell us privately and give us reasonable time to fix it. We will not take legal action against good-faith research that follows this policy.
2. How to report
- Email security@pinevon.com with a clear description, affected URL or component, step-by-step reproduction, and the impact you believe it has.
- Include how to contact you and whether you want credit.
- Do not include real customer data in the report; a minimal proof is enough.
3. What to expect
| Step | Target |
|---|---|
| Acknowledgement | We aim to confirm receipt promptly, usually within a few business days |
| Triage and severity assessment | We aim to assess reports soon after acknowledging them |
| Status updates | Periodic updates while we work on a fix |
| Fix for critical issues | As fast as we reasonably can; timing depends on the issue |
| Credit | Public thanks with your consent once fixed |
These are goals, not guarantees or a service-level commitment. We do not currently run a paid bounty program.
4. In scope
- pinevon.com and its subdomains that we operate, including account.pinevon.com and app.pinevon.com
- GorZesk (formerly Skerry and Anchor) web app and API at gorzesk.pinevon.com
- The installable Pinevon app
5. Out of scope
- Denial-of-service, volumetric or load testing.
- Social engineering, phishing or physical attacks against staff or customers.
- Spam or missing best-practice headers with no demonstrated impact.
- Vulnerabilities in third-party services we use — report those to the vendor.
- Findings that need a rooted device, outdated browser or already-compromised account.
6. Safe-harbor rules
- Only test accounts you own or have permission to use.
- Do not access, change, keep or share other people’s data; stop and report as soon as you can show impact.
- Do not degrade the service or run automated scanners at high volume.
- Do not disclose the issue publicly until we have fixed it or 90 days have passed, whichever is first, and we have agreed a date.
7. security.txt
Our contact details are also published at /.well-known/security.txt.