Penetration testing
Security testing today
AskVault does not yet run an established annual third-party penetration-testing program. Security testing today happens as part of our standard engineering process: internal review of new code for common risk areas before it ships, including:
- External attack surface. Public APIs, widget, hosted page.
- Authentication and authorization. Account, workspace, API keys.
- Multi-tenant isolation. Cross-workspace data leakage attempts.
- Webhook signature handling.
- OAuth integration flows.
- Prompt injection for AI surfaces.
An independent third-party security assessment covering this scope is planned. We'll publish the details here, firm, cadence, and how to request the results, once it's underway.
What a future report will include
Once we complete our first independent assessment, the report will cover:
- Executive summary.
- Findings classified as Critical, High, Medium, Low.
- Remediation timeline per finding.
- Re-test confirmation.
Responsible disclosure
AskVault does not currently run a paid bug bounty program. If you discover a security vulnerability:
- Email
[email protected]with details. - Scope: production askvault.co and api.askvault.co.
- Out-of-scope: social engineering, physical attacks, DOS, third-party dependencies.
Responsible disclosure required; no public exploit before fix.
How to access reports
AskVault has not yet completed an independent penetration test, so there is no report to share today. Once the first assessment is complete, Enterprise prospects and customers will be able to:
- Email [email protected].
- Sign NDA.
- Receive the executive summary.
We'll update this page with the actual process once a report exists.
What we don't publish
For security:
- Details of individual vulnerabilities. Not disclosed publicly.
- Internal tooling details.
Limits
- No third-party report exists yet. No independent penetration test has been completed, so there are no findings, no testing firm and no report to share.
- When a report exists, it will be point-in-time. It will describe the system on the test date, not afterwards.
- When a report exists, it will be NDA-gated. The summary will be shared under agreement, as described above.
Common pitfalls
Treating any penetration-test report as "100% secure". A report is a snapshot of one date. New vulnerabilities emerge after it.
Expecting a zero-finding report. Unrealistic for any vendor. An honest report shows findings and how they were handled.
Asking for a source code review. That is a different exercise from a penetration test, and AskVault does not offer one as a standard service. Email [email protected] to discuss what you need.
FAQ
Can I run my own pen test against AskVault?
Yes with prior written authorization. Email [email protected].
Do you publish CVEs?
No. AskVault does not publish CVEs or public release notes yet (see the changelog page). How we notify customers about an incident is set out in the incident response policy.
How often do you test?
There's no established recurring cadence yet. Security review happens continuously during development, and our first independent third-party assessment is planned.