Movahedi Solutions

Vulnerability Disclosure Policy

1000823315 ONTARIO INC., operating as Movahedi Solutions, Mississauga, Ontario, Canada. Contact: mohammad@movahedi.ca. This is the formal vulnerability disclosure policy for the public site, movahedi.ca. It formalizes the route on the Responsible Disclosure page, with the same scope, the same report contents, the same handling steps, and the same limits. Where the two pages differ in wording, the scope and limits are the same. A security contact file is published at https://movahedi.ca/.well-known/security.txt, with contact and a policy link to the Responsible Disclosure page.

Last updated: October 27, 2026
Back to the Trust Center
Responsible Disclosure

Scope

In scope: movahedi.ca, the public site of Movahedi Solutions. Out of scope: everything else, including client systems, systems belonging to any other party, any system, account, or service that is not movahedi.ca, even if it is linked from movahedi.ca or mentioned on movahedi.ca, and internal tools, inboxes, or accounts used by the company, unless they are part of the public movahedi.ca site itself. If you are unsure whether something is in scope, ask first at mohammad@movahedi.ca, and wait for a reply before testing.

What to include in a report

What was observed, in plain terms, and what you expected to happen instead.
Page affected: the full page address on movahedi.ca where the issue was seen.
Date and time observed, with your time zone.
Steps to reproduce, in order, so the company can repeat them.
Effect, based only on what you actually observed, without speculation beyond what you saw.
Evidence that stays inside scope, such as screenshots or short notes showing only the public movahedi.ca page and the issue itself.
Contact for follow-up, used only for follow-up on the report.

Use the Security Issue Report form, which prepares an email to mohammad@movahedi.ca in your own email program. The site itself does not send the report.

What not to test, and what not to include

Do not test anything outside movahedi.ca. Do not test client systems or other parties' systems. Do not attempt to access accounts, inboxes, or internal tools. Do not attempt to change, delete, or disrupt data, pages, or services. Do not run automated scans, brute-force attempts, denial-of-service testing, or social engineering against the company, its staff, or its contacts. Do not use a reported issue to access data beyond what is needed to demonstrate the issue itself, and stop once the issue is confirmed. Do not include client confidential material, material from another party's system, credentials, tokens, private keys, or personal information about anyone other than your follow-up contact. The report form includes a confirmation checkbox for this rule.

Acknowledgement and re-check process

Reports go to mohammad@movahedi.ca. The company reviews reports in the order received, and prioritizes by the effect described and verified on movahedi.ca. Handling steps: receipt; review of the steps, the page affected, and the evidence; verification by attempting to reproduce the issue; fix or decision based on the verified effect; re-check of the reported page after the fix, using the steps in the report; closure, with the reporter told the outcome for their report. The company aims to acknowledge a report so the reporter knows it was received. This policy does not state a fixed acknowledgement time, because none is promised here. Acknowledgement means receipt and review, not confirmation that the issue is verified, and not a promise of a bounty or a fix date. A reporter may re-check the same public page after the company says a fix is in place, using only the same in-scope steps, and send the re-check result to mohammad@movahedi.ca. Re-checking does not extend scope.

Bounty

No bounty is offered under this policy. A bounty applies only if it is separately approved and funded, in writing, for a specific report or a specific period, and the terms of that approval are stated to the reporter before testing for that bounty begins. Until such an approval exists and is communicated, no payment, reward, or credit beyond acknowledgement and closure notice should be expected for a report. This policy itself is not an approval, and it does not create a bounty program.

Good faith

Reports made in good faith, inside scope, and within the testing limits on this page are welcome. Good faith means: testing only movahedi.ca, stopping once an issue is confirmed, not disrupting the site or its visitors, not accessing data beyond what demonstrates the issue, and not including client confidential material or other parties' material in the report. This policy does not give legal advice, and it does not authorize testing outside scope.

Disclosure acknowledgements

Movahedi Solutions thanks researchers who report security issues on movahedi.ca in good faith and inside scope. Reports are reviewed in the order received, and the reporter is told the outcome for their report, as described above. No researcher report is listed here yet. When a real report arrives, it will be added here, with the reporter's permission, with its date and its remediation. Reports go to mohammad@movahedi.ca, using the route above. No researcher name, bug, date, or remediation time is listed here, because none has arrived, and none is invented.

Scope and limits, stated briefly

This policy is company information, not legal advice for a specific client matter and not a law firm opinion. If a proposed test would break the limits on this page, do not run it, and ask first at mohammad@movahedi.ca.