Vulnerability Disclosure

Scope

This program covers Invoix web applications, APIs, and infrastructure.

Reporting

Please email potential security issues to security@invoix.com with:

• Detailed steps to reproduce
• Expected vs actual behavior
• Screenshots or logs, if available

Response

We aim to acknowledge reports within 2 business days and resolve confirmed vulnerabilities within 30 days.

Safe Harbor

Good-faith security research is welcomed and will not result in legal action.