Responsible Disclosure
Xolvara responsible disclosure: email security@xolvara.com with reproduction steps. Scope includes production app, API, authentication, voice/SMS webhooks, public marketing. Out of scope: physical access, DoS, social engineering, third-party vendor systems. Acknowledgement within 3 business days, triage within 5 business days. Safe harbor for good-faith researchers.