The warning
gets heard.
Report a suspected vulnerability in VEYRSEC privately. Read the reporting scope, response targets, evidence boundaries and coordinated disclosure process.
A clear way to reach us.
Use the private reporting form below for suspected vulnerabilities in VEYRSEC itself. Reports go to the owner’s security inbox. This form is separate from commissioning a client assessment.
We aim to acknowledge a usable report within two business days and provide an initial assessment or progress update within five business days. These are operating targets, not a guaranteed resolution deadline. If more time is needed, we aim to explain the next step.
Minimal evidence. Private handling.
Start with the affected VEYRSEC feature, the behavior you observed and the potential impact. Use a redacted summary. Do not submit passwords, private keys, session tokens, copied customer records or a working exploit through this first-contact form. We can agree a suitable evidence channel if more detail is necessary.
Stop if you encounter unexpected sensitive data or risk disruption. A public reporting channel does not authorize testing. Request written permission before actively probing anything beyond your own account and normal permitted use.
Scope and coordinated disclosure.
Only VEYRSEC-operated application behavior is covered by this reporting channel. Hosting infrastructure, payment networks, third-party services and customer websites need their owners’ permission and reporting channels.
Destructive testing, denial of service, persistence, social engineering and unnecessary data access are outside this policy. No bounty or payment is promised by this page. We review credible reports, discuss remediation privately and coordinate any publication with affected parties.
Send the first warning.
Useful references.
Our process draws on OWASP’s vulnerability disclosure guidance. Our security.txt identifies this reporting channel using the format in RFC 9116.