Responsible Disclosure

Purpose of this disclosure process

This process is intended for reporting suspected security vulnerabilities involving IVT Solution's publicly accessible service, website or authorized product functionality.

It is not intended for ordinary support questions, advertising-performance questions, traffic-quality disagreements, account-management requests or general product feedback.

How to report a potential vulnerability

Please send a clear description of the potential security issue to:

Please do not publicly disclose an unresolved issue before IVT Solution has had a reasonable opportunity to review it and, where appropriate, take protective action.

What to include in a report

Useful reports generally provide enough information to understand and reproduce the suspected issue without including unnecessary personal or sensitive data.

Good-faith security research

Responsible research should be limited to what is reasonably necessary to identify, confirm and explain a potential vulnerability. Testing should be designed to avoid harm to IVT Solution, publishers, users, infrastructure and third parties.

Activities to avoid

Responsible disclosure does not require disruptive, destructive or unnecessarily invasive activity. Please avoid:

• accessing, changing, deleting, downloading or exposing data beyond what is reasonably necessary to demonstrate a suspected vulnerability;
• attempting to obtain passwords, authentication tokens, API keys, recovery information or other account secrets belonging to another person;
• social engineering, phishing, impersonation, credential theft or attempts to deceive IVT Solution personnel, publishers or users;
• denial-of-service activity, excessive automated traffic, resource exhaustion or testing that could degrade service availability;
• deploying malware, ransomware, destructive code or other harmful payloads;
• modifying publisher websites, advertising configurations, traffic, telemetry or reporting without authorization;
• attempting to bypass protection, authentication, access-control or security mechanisms beyond what is reasonably necessary to demonstrate the suspected issue; and
• using a suspected vulnerability for financial gain, unauthorized access, data extraction, advertising manipulation, traffic manipulation or other abusive activity.

Sensitive data and privacy

Please minimize the collection, retention and sharing of personal information, publisher data, authentication material or other sensitive information encountered during research.

Do not include passwords, private keys, authentication tokens, API keys, recovery codes or unrelated personal data in a report. If sensitive information is necessary to explain the issue, describe it in the least revealing way reasonably possible.

How security reports are handled

IVT Solution may review a report, request additional information, investigate the affected functionality, take protective action and determine whether a technical or operational change is appropriate.

The time needed to assess or address an issue depends on its nature, complexity, impact, reproducibility and the systems involved. This page does not establish a guaranteed response, remediation or disclosure timeframe.

We may limit details about internal detection methods, security controls, infrastructure or remediation when disclosure could create additional risk or expose confidential or proprietary systems.

Scope and limitations

This disclosure process applies to potential security issues involving IVT Solution systems or functionality that you are authorized to access or interact with. Third-party products, publisher websites, advertising platforms, hosting providers and other external services remain independently operated and may have their own security-reporting processes.

This page does not create authorization to access private systems or data, does not waive applicable legal rights or obligations, and does not create a bug-bounty, payment or reward program.

Nothing on this page represents certification by Google or another advertising platform, and IVT Solution does not speak on behalf of those platforms.

Security contact