Penetration testing
Security testing today
AskVault does not yet run an established annual third-party penetration-testing program. Security testing today happens as part of our standard engineering process — internal review of new code for common risk areas before it ships, including:
- External attack surface. Public APIs, widget, hosted page.
- Authentication and authorization. Account, workspace, API keys.
- Multi-tenant isolation. Cross-workspace data leakage attempts.
- Webhook signature handling.
- OAuth integration flows.
- Prompt injection for AI surfaces.
An independent third-party security assessment covering this scope is planned. We'll publish the details here — firm, cadence, and how to request the results — once it's underway.
What a future report will include
Once we complete our first independent assessment, the report will cover:
- Executive summary.
- Findings classified as Critical, High, Medium, Low.
- Remediation timeline per finding.
- Re-test confirmation.
Responsible disclosure
AskVault does not currently run a paid bug bounty program. If you discover a security vulnerability:
- Email
security@askvault.cowith details. - Scope: production askvault.co and api.askvault.co.
- Out-of-scope: social engineering, physical attacks, DOS, third-party dependencies.
Responsible disclosure required; no public exploit before fix.
How to access reports
AskVault has not yet completed an independent penetration test, so there is no report to share today. Once the first assessment is complete, Enterprise prospects and customers will be able to:
- Email security@askvault.co.
- Sign NDA.
- Receive the executive summary.
We'll update this page with the actual process once a report exists.
What we don't publish
For security:
- Specific vulnerabilities found. Not disclosed publicly.
- Internal tooling details.
- Specific firms used (under NDA with them).
Limits
- Reports are point-in-time. Snapshot of test date.
- Continuous improvement. Between tests, we ship security improvements regularly.
- NDA-gated. Detailed reports under agreement.
Common pitfalls
Treating pen test report as "we're 100% secure". It's a snapshot. New vulnerabilities emerge.
Demanding zero-finding report. Unrealistic. Honest reports show findings being managed.
Requesting source code review. Different exercise. Available under NDA on Enterprise.
FAQ
Can I run my own pen test against AskVault?
Yes with prior written authorization. Email security@askvault.co.
Do you publish CVEs?
For customer-impacting vulnerabilities, yes via changelog and incident-response disclosure.
How often do you test?
There's no established recurring cadence yet. Security review happens continuously during development, and our first independent third-party assessment is planned.