// RESPONSIBLE DISCLOSURE
Report a security issue in Veyra.
Veyra asks customers for access to their most sensitive systems. The least we can do is make reporting a problem in our own straightforward, and commit publicly to how we will respond.
SECURITY CONTACT
Machine-readable contact details are published at /.well-known/security.txt in line with RFC 9116.
A PGP key for encrypted reports will be published here once key management is in place. Until then, please avoid including exploitation detail in an initial unencrypted email — send a summary and we will arrange a secure channel.
OUR COMMITMENTS
| Stage | Target |
|---|---|
| Acknowledgement | 1 business day |
| Initial assessment and severity | 3 business days |
| Status update cadence | Every 7 days until resolved |
| Critical fix target | 7 days |
| High fix target | 30 days |
| Medium / low fix target | 90 days |
| Coordinated disclosure | By agreement, default 90 days |
What is in scope.
If you are unsure whether something is in scope, ask first. We would rather answer a question than have a researcher guess.
IN SCOPE
- The Veyra web application and dashboard
- The Veyra API
- Authentication, session handling, and account management
- Tenant isolation and authorization boundaries
- The Veyra GitHub App and its permission model
- This marketing website
- Publicly reachable Veyra infrastructure
OUT OF SCOPE
- Denial of service, volumetric, or stress testing
- Social engineering or phishing of Veyra staff, customers, or vendors
- Physical attacks against offices or personnel
- Any testing that accesses, modifies, or destroys data belonging to another party
- Reports generated solely by an automated scanner with no demonstrated impact
- Missing best-practice headers with no demonstrable exploit path
- Software version disclosure without a working proof of concept
- Vulnerabilities in third-party services Veyra does not control
- Self-XSS, or issues requiring a fully compromised victim device
How to test without causing harm.
- USE YOUR OWN ACCOUNTS
- Test only against accounts and organizations you control. If you need a second account to demonstrate a tenant-isolation issue, create one — do not use somebody else’s.
- STOP AT PROOF
- Once you have established that a vulnerability exists, stop. Do not enumerate further records, escalate further, or maintain persistence to see how far it goes.
- DO NOT EXFILTRATE DATA
- If you encounter data belonging to another party, stop immediately, do not save or share it, and tell us what you saw so we can assess exposure.
- RESPECT AVAILABILITY
- No denial of service, no automated scanning at volumes that degrade service, no destructive testing.
- GIVE US TIME
- Allow us a reasonable period to remediate before any public disclosure. Our default is 90 days, and we will work with you if a fix legitimately needs longer.
- ONE ISSUE PER REPORT
- Separate reports for separate issues make triage faster and reduce the chance something is missed.
Safe harbour
If you make a good-faith effort to comply with this policy during your research, Veyra will consider your activity authorized, will not pursue or support legal action against you in relation to it, and will work with you if a third party raises a concern. This statement is provided in good faith and does not, and cannot, waive the rights of any third party. Testing that goes outside this policy — particularly anything touching another party’s data — is not covered.
Submit a vulnerability report
Email is preferred for anything sensitive. This form is here so that reporting is never blocked by not having a mail client to hand.