Vulnerability Disclosure Policy

Email security@vigilisai.com. Please include:

• what you found and where (the URL, endpoint, app screen or version);
• the steps to reproduce it, and any proof of concept;
• what you think an attacker could do with it;
• how we can reach you, and whether you would like to be credited.

A short report is fine. We would rather hear early than not at all.

• We acknowledge your report within one business day.
• We tell you whether we can reproduce it, and keep you updated until it is fixed.
• We fix confirmed issues within our published fix times: critical within 15 days and high within 30 days of confirming them, and sooner where we can.
• We tell you when it is fixed, and credit you publicly if you would like us to.
• We never pass your details to anyone outside Vigilis without your permission.

We don't run a paid bug bounty today. We will say so here if that changes.

If you make a good-faith effort to follow this policy, we consider your research authorized. We will not take legal action against you or ask anyone else to, including under anti-hacking laws such as the US Computer Fraud and Abuse Act or anti-circumvention laws such as the DMCA, and we will not treat it as a breach of our Terms of Service. If someone else takes action against you for research that followed this policy, we will make clear that it was authorized.

If you are unsure whether something is allowed, ask us at security@vigilisai.com before you go ahead.

• Test only with accounts you own or have permission to use. Never access, change or delete another customer's data.
• If you come across personal data or customer information, stop, don't keep or share it, and tell us what you saw.
• Don't disrupt the service: no denial-of-service, load testing or spam.
• Use automated scanners only at a gentle rate.
• No social engineering of our staff or customers, and no physical testing.
• Give us a reasonable chance to fix the issue before telling anyone else. We ask for 90 days, or until the fix is out if that is sooner, and we will agree a date with you.

In scope: the Vigilis platform, including the web portal at portal.vigilisai.com, our API and our mobile apps, and our websites at vigilisai.com and trust.vigilisai.com.

Out of scope: the services of the companies we rely on (for example AWS, Clerk or Vercel), which you should report to them; findings that need a compromised device or account; and reports about missing best-practice settings, such as a header or an email record, that don't come with a way to cause harm.