Security and Vulnerability Disclosure

Effective date: 26 October 2026 · Version 1.0

1. Reporting a vulnerability

Email team@clvlabs.tech. It is the only channel, and the one published in our security.txt. Please do not open a public issue or describe the problem anywhere public before it is fixed: Propel holds other people's data, and a public description reaches the version still running.

Most useful in a report, in this order:

• what an attacker ends up able to do, in one sentence;
• the steps to reproduce it, including the role and the workspace you acted as;
• how far it reaches, as far as you know: your account, one workspace, every workspace;
• the time of the requests, or a request id if an answer showed one.

2. Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you, and we will say so to anyone who asks. Good faith means:

• you do not access, change, keep or share data that is not yours, and you stop at proof: if you reach someone else's data, record only what shows the problem and tell us;
• you run no destructive or high-volume tests, and no automated scans, against the live service: it serves real customers. If reproducing something needs volume, tell us what you would run and we will run it;
• you give us reasonable time to fix the problem before you disclose it publicly.

The safe harbour covers Propel only. Testing our providers (hosting, Google, Microsoft, Stripe, email and AI providers) is between you and them.

3. Scope

In scope: the Propel app and its API, the public REST API, the website at propeltech.io, the public endpoints (webhooks, forms, booking and quote pages), and how workspaces are kept apart from one another.

Out of scope: findings against our providers themselves; denial of service by volume; scanner output without a demonstrated impact; social engineering of our staff or customers; physical access.

4. What happens next

• We acknowledge a report within three working days, tell you whether we reproduced it, and tell you when it is fixed. If a report goes quiet for more than a week, write again.
• We credit reporters who want to be credited.
• Propel is a hosted service: a fix applies to everyone once it is deployed, and there is no older version to update.

Published and in force as of the date above. Reports go to CLV LABS SL, the company that provides Propel.