Responsible disclosure
Found a security issue? We want to hear about it.
If you believe you've found a security vulnerability in Gruvle Radar, please report it privately rather than opening a public issue. We ask that you:
- Give us a reasonable amount of time to investigate and fix an issue before disclosing it publicly.
- Avoid accessing, modifying, or deleting data that isn't your own.
- Avoid actions that could degrade service for other users (e.g. denial of service testing).
- Share enough detail (steps to reproduce, affected endpoint, impact) that we can verify and fix it quickly.
What's already in place
Every integration credential is encrypted at rest through a single CredentialVault service; every outbound fetch to a customer-supplied URL is SSRF-guarded at both the DNS-resolution and TCP-connect stages; every tenant-scoped endpoint enforces membership server-side; AI output is strictly schema-validated and never directly executes an action. The full architecture is documented in docs/SECURITY.md in the project repository.
Scope
This deployment is a reference implementation. If you're evaluating it for your own use, please reach out through your normal support channel with this organization before running automated scanners against a production instance.