Delivami

Legal & Studio Compliance

Transparent agreements governing creative file delivery, pay-to-unlock escrow, payout settlement, and data sovereignty on Delivami.

Vulnerability Disclosure Policy

Version 2026-10-27 · Last updated: November 2026

Security is at the core of Delivami’s architecture—from AES-256-GCM encrypted R2 vaults and HMAC-SHA256 webhook verification to WebAuthn passkeys and automated withdrawal security holds. We welcome coordinated disclosures from independent security researchers who identify potential vulnerabilities across our platform.

1. In-Scope Systems

  • app.delivami.com — Core studio application, authentication (Better Auth), invoicing, and client portal endpoints;
  • app.delivami.com/api/v1/* — Public Studio REST API, scoped API key validation (dv_...), and webhook dispatchers;
  • delivami.com — Marketing, documentation, and regional routing surfaces;
  • Pay-to-Unlock cryptographic gate logic and presigned download token generation.

2. How to Submit a Report

If you discover a security vulnerability, please email our security engineering team at security@delivami.com with:

  • The affected URL, API endpoint, or parameter;
  • Clear, step-by-step reproduction instructions or a minimal proof-of-concept (PoC) script;
  • An assessment of the potential security impact (e.g., tenant boundary bypass, unauthorized vault access, or settlement manipulation).

3. Rules of Engagement

To qualify for Safe Harbor protection, your research must adhere to the following rules:

  • Test Only Your Own Accounts: Perform all testing exclusively against studio and client test accounts that you own and control. Never access, modify, or download another creator’s master files or invoice records.
  • No Service Disruption: Do not execute Denial of Service (DoS/DDoS) attacks, automated credential-stuffing floods, or high-volume SMS/OTP exhaustion attacks.
  • No Social Engineering or Physical Intrusion: Do not phish, pretext, or target Delivami employees, customers, or upstream providers (Cloudflare, Neon, Paystack, Dojah).
  • Coordinated Disclosure: Allow our engineering team a reasonable window (up to 30 days) to remediate and verify the fix before publishing any technical details publicly.

4. Safe Harbor & Recognition

When you conduct security research in good faith and in compliance with this policy, Delivami considers your testing authorized, will not initiate legal action against you, and will work with you to validate and resolve the issue promptly. Valid, high-impact findings are eligible for security researcher recognition and discretionary rewards.