Vulnerability Disclosure Policy

Validyn welcomes reports from security researchers who identify potential vulnerabilities in our website or application. If you believe you’ve found a security issue, please contact [email protected].

How to report an issue

Please include:

• The affected page, service, or feature.
• A description of the vulnerability and its potential impact.
• Steps to reproduce it, with screenshots or a minimal proof of concept where helpful.
• An email address where we can follow up.

Do not include passwords, access tokens, or other people’s personal or confidential information in your report.

Scope and responsible testing

This policy covers websites and applications owned and operated by Validyn. It does not authorize testing of third-party services.

When investigating a potential issue:

• Use only accounts and data you own or have explicit permission to test.
• Avoid disrupting services, changing or deleting data, or accessing other users’ information.
• Do not conduct denial-of-service attacks, social engineering, phishing, or physical security testing.
• If you encounter sensitive information, stop testing immediately and report the issue without copying, downloading, or sharing that information.
• Limit testing to what is necessary to demonstrate the issue.

If you are unsure whether testing is within scope, contact us before proceeding.

What happens next

We will review your report and may contact you for additional information. We will assess the issue’s impact, determine appropriate next steps, and communicate with you about its status.

Please keep vulnerability details private while we investigate and address the issue. Contact us to coordinate any public disclosure.

Rewards

Validyn does not currently operate a paid bug bounty program. Reports submitted under this policy are voluntary and do not carry a promise of payment or other compensation.

We appreciate your help keeping Validyn and our customers secure.