​

In September 2026, we received a report through our Bug Bounty Program classified as critical, claiming that the AcheiVaga production database was configured without Row Level Security, allowing unrestricted reads and writes by any unauthenticated visitor.

We carried out a full technical review, directly inspecting the security configuration of the production database. The claim was confirmed to be partially true: Row Level Security was only partially enabled and configured on some of the system's tables. The public read access the researcher identified is the product's expected behavior — it is a public directory of parking spaces, designed from the start to be searchable without logging in.

We handled the case with the full rigor of a critical incident until the analysis was complete, and used the opportunity to proactively strengthen our security posture:

1. We deployed automated, continuous checks of database access configuration.

2. We strengthened the password policy for all system accounts, requiring long, complex passwords.

3. We now require password changes every 90 days.

4. We formalized our internal process for responding to security reports, with deadlines defined by severity.

These measures follow internationally recognized guidelines for information security management (ISO/IEC 27001, 27002 and 27005) and responsible vulnerability handling (ISO/IEC 29147 and 30111).

We thank the researcher for the responsible disclosure and for conducting the tests carefully, with no impact on real user data.

We continue to encourage the security community to report potential vulnerabilities through our Bug Bounty Program.