Security

Responsible disclosure policy — how to report a vulnerability and what to expect from us.

If you have found a security issue in Navige, please email us directly at hello@navige.ai. Do not open a public GitHub issue for security vulnerabilities.

What we ask

Give us a reasonable amount of time to investigate and fix the issue before disclosing it publicly.
Do not access or modify data belonging to other customers.
Do not perform denial of service attacks, spam, or social engineering.
Provide enough detail for us to reproduce the issue — steps, curl commands, screenshots, or a proof of concept all help.

What you can expect from us

An acknowledgement within 2 business days of receiving your report.
Regular updates while we investigate — at least once a week.
Credit in our disclosure notes if you want it.
We will not take legal action against researchers who act in good faith under this policy.

In scope

Target	Examples
api.navige.ai	Authentication bypass, tenant data leakage, injection, approval flow manipulation
app.navige.ai	XSS, CSRF, session issues
navige.ai	Reflected or stored XSS, open redirects
Navige SDKs	npm package, Python SDK — logic or security bugs

Out of scope

Rate limiting on non-sensitive endpoints
Missing security headers that have no practical exploit path
Clickjacking on pages with no sensitive actions
Issues requiring physical access to a device
Vulnerabilities in third-party services we use (report those to the provider directly)
Automated scanner output without a demonstrated impact

Safe harbour

We consider security research conducted under this policy to be authorised. We will not pursue civil or criminal action against researchers who discover and report vulnerabilities in good faith and in accordance with this policy. If a third party initiates legal action against you for research you conducted under this policy, we will make clear that your actions were authorised by us.

How to report

Email: hello@navige.ai

You can also reach us via the /.well-known/security.txt standard contact file.

What we track

Every report we receive is logged with: date received, severity assessment, fix date, and whether it was publicly disclosed. We are building a track record we can share with enterprise customers and auditors.