Overview
We take security seriously and welcome reports from security researchers who discover vulnerabilities in our platform. This document outlines our responsible disclosure process.
How to Report a Vulnerability
If you've discovered a security vulnerability in Verusight, please report it to:
What to Include
To help us investigate and resolve the issue quickly, please provide:
- A detailed description of the vulnerability
- Steps to reproduce the issue
- The potential impact (e.g., data exposure, authentication bypass)
- Any proof-of-concept code or screenshots
- Your contact information for follow-up
Our Commitment
- We will acknowledge your report within 48 hours
- We will investigate the issue promptly and keep you informed of progress
- We will not take legal action against researchers who follow responsible disclosure guidelines
- We will credit you in our security acknowledgments (if you wish)
Responsible Disclosure Guidelines
We ask that you:
- Do not access or modify data belonging to other users
- Do not perform destructive testing (e.g., denial of service)
- Do not publicly disclose the vulnerability until we've had a reasonable time to address it
- Do not use automated scanning tools in a way that degrades our service
- Report the vulnerability directly to us before sharing it with third parties
Scope
The following are in scope:
- verusight.com (web application)
- support.verusight.com (help portal)
- API endpoints
- Authentication and session management
- Data access controls and authorization
Out of Scope
- Social engineering attacks against Verusight staff
- Physical attacks against Verusight infrastructure
- Denial of service attacks
- Third-party services (Polar, Chatwoot) — report to those vendors directly
Bug Bounty
We do not currently operate a formal bug bounty program. However, we value and appreciate security research contributions and will acknowledge your efforts.