Responsible Disclosure
Report
Send vulnerability reports to njaal@valoresearch.org with the affected URL or component, reproduction steps, impact and any supporting evidence. Avoid including unnecessary personal data.
Good-faith research
Good-faith testing should minimise impact and stop when access to data, accounts or capabilities beyond what is necessary to demonstrate the issue becomes possible.
Do not
Do not perform denial-of-service testing, destructive testing, social engineering, credential attacks, persistence, mass scanning, or access, alter, download or disclose data belonging to others.
Handling
Reports will be assessed based on reproducibility, impact and affected surface. We may ask for additional technical detail. Remediation and disclosure timing depend on severity and the systems involved.
Safe harbour
VALO Research does not intend to pursue action against good-faith security research that follows this policy, stays within applicable law and avoids harm. This statement cannot authorise activity against third-party systems.
Disclosure
Please allow reasonable time to investigate and remediate before public disclosure.