Reporting
Send reports to . Please include a description, affected component or URL, steps to reproduce and your assessment of impact. You may encrypt your report; our public key is available on request.
Scope
This policy covers this website and any Verity Command software you are authorized to test. Third-party services are out of scope.
Guidelines
- Test only what you need to demonstrate the issue.
- Do not access, modify or retain data that is not yours.
- Do not run denial-of-service, social engineering or physical attacks.
- Give us reasonable time to fix the issue before public disclosure. We propose 90 days and will agree a date with you.
What we commit to
- Acknowledge your report within three working days.
- Keep you informed while we investigate and fix.
- Credit you publicly, if you wish, once the issue is resolved.
Safe harbor
If you act in good faith and within these guidelines, we will not pursue legal action against you for your research, and we will support you if a third party does.