Zuvo customer support policy for penetration testing
Customers of Zuvo are permitted to carry out security assessments or penetration tests of their hosted Zuvo project components. This testing may be carried out without prior approval for the customer services listed under permitted services. Zuvo does not permit hosting security tooling that may be perceived as malicious or part of a campaign against Zuvo customers or external services. This section is covered by the Zuvo Acceptable Use Policy (AUP).
It is the customer’s responsibility to ensure that testing activities are aligned with this policy. Any testing performed outside of the policy will be seen as testing directly against Zuvo and may be flagged as abuse behaviour. If Zuvo receives an abuse report for activities related to your security testing, we will forward these to you. If you discover a security issue within any of the Zuvo products, contact Zuvo Security immediately.
Furthermore, Zuvo runs a Vulnerability Disclosure Program (VDP) with HackerOne, and external security researchers may report any bugs found within the scope of the aforementioned program. Customer penetration testing does not form part of this VDP.
Permitted services
- Authentication
- Database
- Edge Functions
- Storage
- Realtime
https://<customer_project_ref>.supabase.co/*https://db.<customer_project_ref>.supabase.co/*
Prohibited testing and activities
- Any activity contrary to what is listed in the AUP.
- Denial of Service (DoS) and Distributed Denial of Service (DDoS) testing.
- Cross-tenant attacks, testing that directly targets other Zuvo customers' accounts, organizations, and projects not under the customer’s control.
- Request flooding.
Terms and conditions
The customer agrees to the following,
Security testing:
- Will be limited to the services within the customer’s project.
- Is subject to the general Terms of Service.
- Is within the Acceptable Usage Policy.
- Will be stopped if contacted by Zuvo due to a breach of the above or a negative impact on Zuvo and Zuvo customers.
- Any vulnerabilities discovered directly in a Zuvo product will be reported to Zuvo Security within 24 hours of completion of testing.