Vulnerability disclosure

Invena Labs Limited (trading as invena)
167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom
Company number 17237229
Registered in England and Wales

Last updated: 30 October 2026

If you have found a security issue in Invena, tell us so we can look into it.

This page explains how to report an issue. It is not a bug-bounty programme.

How to report

Report a vulnerability using our security contact form. You may also email security@invena.app; for secure reporting options, see our security.txt file.

Please include:

Do not include passwords, authenticator codes, or the contents of someone else’s documents. Do not open a public issue for a security report.

Good-faith reporting. Invena will not bring legal action against a person solely for making a good-faith vulnerability report in accordance with this policy, provided that the person does not access, alter, copy, disclose, retain, or misuse personal data or other information, and does not disrupt the Service or use the vulnerability for an unlawful purpose.

This commitment does not limit Invena’s rights in relation to conduct outside this policy, including unauthorised access or disclosure, material harm, extortion, fraud, threats, disruption, or misuse of information obtained during testing.

Our Terms prohibit probing or testing security vulnerabilities without our prior written consent. This page does not give that consent. The limited protection above applies only to a report made within the rules on this page.

We aim to acknowledge and respond to reports within five business days, but this is an operational target and not a contractual service level.

What this covers

What this does not cover

Give us a reasonable chance to investigate before you share the details publicly.

For a concern about your own account, use the security contact form.

Vulnerability disclosure · invena