Security Policy & Responsible Disclosure

Effective October 30, 2026 · Belvic Security, operated by Belvic Group, St. Catharines, Ontario, Canada

We protect other businesses for a living, so we want to hear about any weakness in our own systems. If you believe you've found a security vulnerability in Belvic Security, please tell us privately and give us a chance to fix it before anyone else learns about it.

How to report

Email [email protected] with the subject Security report. Please include:

• What you found and where (the page, URL or endpoint)
• Step-by-step instructions to reproduce it
• What an attacker could do with it
• How we can reach you, and whether you'd like to be credited

Please don't include personal information about anyone else in your report.

What we commit to

• Acknowledge your report within 3 business days
• Give you an assessment and expected timeline within 10 business days
• Keep you updated until it's fixed, and tell you when it is
• Credit you publicly once it's fixed, if you'd like

We don't run a paid bug bounty, but we're grateful for every good-faith report.

In scope

• belvicsecurity.ca and its subdomains, including the free tools and their /api/ endpoints
• Email sent from belvicsecurity.ca (for example, a way to send email that passes as ours)
• Reports, fix guides and links we send to clients

Out of scope

• Denial-of-service, load testing or anything that degrades the service for others
• Social engineering, phishing or physical attacks on us or our clients
• Spam or brute-force attempts against our forms
• Services we use but don't run (such as Cloudflare, Square, Resend and GitHub): please report those to the provider
• Automated scanner output without a demonstrated, real impact
• Results our tools show about other people's domains (that's what the tools are for)

Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you, and we'll treat your research as authorised. That means:

• Only test against your own accounts and data, and stop as soon as you've shown a problem exists
• Don't access, change or keep anyone else's data. If you come across it, stop and tell us
• Don't disrupt the service or degrade it for others
• Give us a reasonable time to fix the issue (normally up to 90 days) before talking about it publicly

Machine-readable contact

Our security.txt file lists this policy and our security contact, following RFC 9116.