Vulnerability management

Coveo has a strict code review process in place that leverages both manual and automated security testing, such as static application security testing (SAST) and dynamic application security testing (DAST). This makes sure that Coveo software is free of malware in the production environment. Coveo uses a third-party automated vulnerability scanner for code analysis before each release. Proprietary code isn’t available to customers for review. Open source code is publicly available and maintained within Coveo’s GitHub account. Copyright compliance of open source components is verified quarterly.

Coveo prioritizes security and encourages users and members of the broader security community to privately report suspected vulnerabilities. Vulnerabilities can be reported to security[@]coveo.com.

All issues reported to the Coveo Security team are investigated promptly in collaboration with the reporter and remediated as quickly as possible. The security team may elect not to disclose information publicly, or to refrain from disclosure until the relevant issues are mitigated and affected customers are notified.

When reporting a security concern, provide as much detail as possible, including:

If the information is sensitive, ask us for a secure exchange method and don’t send any executable attachments.

The Coveo Security team performs frequent internal penetration tests using a variety of tools. However, these reports can’t be shared with customers.

Coveo maintains an active bug bounty program and generates an annual report of the vulnerabilities discovered by third-party experts. The latest report is available under Coveo’s Non-Disclosure Agreement (NDA).

Coveo accommodates Customers wanting to perform penetration tests on the Coveo Hosted Services. Such tests require specialist technical expertise and should be pre-approved by the Coveo Security team.

To request a technical review, Customers must contact Coveo Support and provide, at least 7 days before the test, the following information:

Coveo commits to conducting performance tests on its Cloud products, therefore ensuring that the expected performances are always achieved. For details regarding the performances you should expect, see your Coveo Customer Agreement.

With Coveo ensuring the smooth functioning of its products, you shouldn’t need to perform stress or benchmark tests. Per the Coveo Customer Agreement, you may not access Coveo products for purposes of monitoring their availability, performance, or functionality without the prior written consent of the Coveo Security Officer. Similarly, any other benchmarking or competitive purposes also require this written consent. Using any tool designed to automatically emulate the actions of a human user (such tools are commonly named robots) in conjunction with Coveo is also prohibited.

However, if you must conduct such tests for contractual or legal reasons, you’re required to get an authorization from Coveo beforehand. Failure to receive authorization could trigger a throttling process impacting your entire Coveo organization, and Coveo could suspend service provision. Coveo will consider approving reasonable requests.