Vulnerability disclosure policy

Scope

This policy covers systems Veync itself operates: this website, our product infrastructure, and the services we expose to customers. It does not cover a customer's environment — if you believe you have found a vulnerability in a system belonging to one of our customers, contact that organisation directly rather than us.

Findings in third-party software we merely use are forwarded to the vendor under coordinated disclosure, and we will tell you when we have done so.

Safe harbour

If you make a good-faith effort to comply with this policy during your research, Veync will not initiate or support legal action against you in connection with it, and will not report you to law enforcement for it. If a third party brings action against you for activity conducted under this policy, we will make that good faith known.

Good faith means: you stop as soon as you have established a vulnerability exists, you do not access or exfiltrate data belonging to anyone else, you do not degrade service for others, you do not use social engineering against our staff or our customers, and you give us a reasonable opportunity to fix the issue before telling anyone else.

This clause exists because a disclosure policy without one asks a researcher to take a legal risk on our behalf, which is the main reason findings go unreported.

What to send

A description of the issue, the affected endpoint or component, the steps needed to reproduce it, and an assessment of what an attacker could achieve with it. A minimal reproduction is far more useful than a scanner export.

Please do not include data belonging to any third party. If demonstrating the issue necessarily exposed such data, say so and describe it rather than attaching it.

If your report contains anything sensitive, ask [email protected] for our current public PGP key before you send it.

What to expect from us

We acknowledge every report within three working days and give an initial assessment within ten. We will tell you whether we consider the issue in scope, our view of its severity and our intended remediation timeline, and we will keep you updated as that changes.

We credit researchers by name in any resulting advisory unless you ask us not to. Veync does not currently run a paid bounty programme and we will say so plainly rather than leaving the question open.

Out of scope

Reports consisting solely of automated scanner output with no demonstrated impact, missing security headers with no exploitable consequence, theoretical issues with no realistic attack path, denial of service through volume, social engineering of our staff, and physical attacks on our offices.

This list is not a judgement on the technique. It is a statement about what we can act on.