Security Policy

If you found a vulnerability in REVERT itself (our API, model serving, or auth flow), please follow the disclosure path below. If you are a security researcher evaluating our practices, this document answers your questions in one read.

1. Responsible disclosure

Contact: ssolovev@revert.pro with subject prefix [Security]. PGP key on request.

We commit to:

• Acknowledge receipt within 48 hours
• Triage and assign severity within 7 days
• Aim to patch critical issues within 14 days (best-effort during early access)
• Public credit (your choice) and Hall of Fame listing
• Cash bounty for confirmed exploits (USD $100 – $5 000 depending on severity), paid out-of-pocket by the founder — REVERT is pre-revenue

We ask you to:

• Give us 90-day disclosure window before going public
• Not perform DoS, social engineering, or exfiltrate user data
• Test against your own account / contracts, not others

2. security.txt

Machine-readable per RFC 9116: /.well-known/security.txt

3. Our security practices

Infrastructure

• TLS 1.2+ everywhere (Vercel + Let's Encrypt)
• API service on hardened DigitalOcean droplet (UFW firewall, systemd hardening, non-root user)
• Database on Supabase (Frankfurt EU); row-level security on user data
• Secrets in environment variables only — never in code or git
• Service-role keys rotated after every administrative session
• No third-party trackers, analytics, or ads (XSS surface minimized)

Code & supply chain

• Public source on GitHub (model & scoring code) — auditable
• Pinned dependencies; renovate weekly
• Model files (joblib) loaded only from first-party paths — no untrusted deserialization
• Frontend uses safe DOM construction (no innerHTML with user data)

Auth

• Supabase Auth (magic link, no passwords stored)
• JWT tokens short-lived (~1 hour); refresh tokens rotated
• No legacy session cookies; no third-party SSO yet

4. Bug bounty hunting — data-lane separation

REVERT has both a B2B SaaS arm (this product) and an experimental bounty-hunting research arm. To prevent any conflict of interest, we maintain strict separation:

• Lane 1 (B2B API): customer-submitted scans are private; never used for our bounty hunting work
• Lane 2 (Public firehose): newly deployed mainnet contracts (public by definition); fair game for our research
• Lane 3 (Paid hunt-for-me): customer explicitly retains us to hunt their own contracts; covered by written agreement

Enforcement is in code: scan-log rows are tagged with their lane, and our bounty research scripts refuse to read lane-1 rows. Audit log records every cross-lane access attempt.

5. Incident response

If we suffer a breach affecting customer data, we will:

• Notify affected customers within 72 hours (GDPR Art. 33)
• Post a public post-mortem within 14 days
• Compensate paid customers per the SLA in Terms §5

6. No SOC 2 / ISO 27001 yet

REVERT is a solo-founder operation. We hold no formal compliance certifications. We follow security best practices but cannot satisfy procurement checklists that require third-party-audited certifications. If your procurement gates require SOC 2, please let us know — we plan to pursue it once revenue justifies the audit cost (~$30k/year for startups).

7. Acknowledgments

Researchers credited here have responsibly disclosed issues to REVERT. (List populated as disclosures arrive.)