Coordinated Vulnerability Disclosure Policy
We welcome collaborative research from the global security community. We commit to working with researchers who identify security flaws in our platform under responsible guidelines.
Our Legal Safe Harbor Commitment
If you conduct vulnerability research in good faith and adhere to the guidelines set forth on this page, we consider your activities authorized under the Computer Fraud and Abuse Act (CFAA), the DMCA, and related anti-hacking statutes. We will not pursue civil or criminal action against you.
1. Program Scope
- *.vaptportal.com
- api.vaptportal.com
- auth.vaptportal.com
- Audit report delivery webhook endpoints
- Volumetric DDoS or resource starvation attacks
- Social engineering / Phishing against our staff
- Physical attacks against data centers or offices
- Third-party cloud infrastructure (AWS/Cloudflare)
2. Rules of Engagement
- Do no harm: Stop testing immediately upon discovering proof-of-concept (PoC) demonstrating unauthorized access or privilege escalation. Do not read or alter customer data.
- Single account testing: Use your own accounts created for security testing purposes only.
- Coordinated disclosure: Give our engineering team at least 90 calendar days to remediate before publishing any advisory or technical write-up.
3. Response SLA & Triage Milestones
How to Submit Findings
Send detailed steps to reproduce, full HTTP request/response proofs, and potential impact assessment directly to our security team:
Please encrypt all sensitive proof-of-concept reports using our public PGP key.
Security Hall of Fame
Eligible submissions meeting CVSS 7.0+ will be credited in our public Security Hall of Fame.
Hall of Fame Open