Vulnerability Disclosure Policy

• The website at vitisecurity.com.
• The customer portal at vitisecurity.com/portal/, including sign-in, account, billing and license pages.
• Vexta, our vulnerability scanner: the application and the license, download and update services it uses.

If you are not sure whether something is covered, email us before you test it.

• Denial of service, load or stress testing, or anything else that degrades the service for other people.
• Social engineering of our staff, clients or partners, including phishing, phone calls and pretexting.
• Physical attacks on offices, equipment or people.
• Third-party services we use, such as payment processors, live chat, email delivery and analytics providers. Please report those to the provider directly.
• Systems that belong to our clients, including systems we manage on their behalf.
• Output from automated scanners without a demonstrated, reproducible issue.

• Only test accounts you own, or accounts whose owner has given you permission.
• Do not access, change, delete or keep data that is not yours. If you reach personal data or another customer's data, stop, and include only what is needed to show the issue.
• Keep automated testing to a low request rate, and stop straight away if you notice any impact on availability.
• Do not use an issue beyond what is needed to show it exists: no pivoting to other systems, no persistence.
• Keep the details confidential until the issue is fixed or the disclosure window below has passed.

Email [email protected]. It helps us move quickly if your report includes:

• The affected URL, component, or Vexta version.
• What the issue is, and what an attacker could do with it.
• Steps to reproduce, with a proof of concept, request and response, or screenshots.
• When you tested and the IP address or addresses you tested from, so we can find your traffic in our logs.
• How to reach you for follow-up questions.

One issue per report makes tracking easier. English is preferred.

• We acknowledge every report within one business day.
• We tell you whether we can reproduce the issue and how serious we think it is, and keep you updated while we fix it.
• We tell you when it is fixed, and you are welcome to check the fix.
• We keep your report confidential and do not share your personal details outside VITI Security without your permission, unless the law requires it.

If you act in good faith and follow the rules on this page, we consider your research authorised. We will not take legal action against you, or ask law enforcement to act against you, for that research.

This covers only systems that are in scope above. It cannot authorise testing of systems we do not own, including our clients' systems and third-party services.

We do not run a paid bug bounty and do not pay for reports. We are grateful for every good-faith report all the same.

Please allow us up to 90 days from your report to fix the issue before you publish anything about it. If a fix needs longer, we will explain why and agree a date with you. If we fix it sooner, we are happy to agree an earlier date together. We would appreciate seeing a draft of any write-up before it goes out.

Security reports: [email protected]. Machine-readable contact details are in our security.txt.