Security advisories
When a security issue affects Card Vault customers — a vulnerability in the platform, an SDK, or a dependency that requires action on your side — the advisory is published on this page. Each advisory states what is affected, the severity, the versions involved, what Card Vault has already done, and exactly what (if anything) you need to do.
Current advisories
There are no published advisories. Nothing is being withheld: no issue requiring customer action has occurred since this channel was established (August 2026). When one exists, it will appear here first.
How you are notified
- This page is always current and requires no account.
- Direct notice: advisories that require customer action are additionally emailed to each account's registered security contact. Register or update yours in the account console — an account without a security contact only has this page.
- Release notes: security-relevant fixes also appear in the release notes, including ones that never warranted a standalone advisory.
Reporting a vulnerability to us
Our security contact and disclosure terms are published at /.well-known/security.txt (RFC 9116): security@cardvault.com, acknowledgement within 2 business days, assessment within 5. Good-faith research within the policy is welcome; there is no bug bounty. Please do not access data belonging to anyone other than yourself.
Advisory format
Every advisory carries: an identifier (CVA-YYYY-NNN), publication and last-updated dates, severity (Critical / High / Medium / Low), affected components and version ranges, a plain-English description, remediation status on the Card Vault side, and required customer action. Updates are amended in place with the change dated.