Responsible Disclosure · Pilot by VerbosLabs

48h

Initial response

7 days

Critical fix target

30 days

Coordinated disclosure

Our Commitments

We will acknowledge your report within 48 hours.
We will not take legal action against researchers who follow this policy in good faith.
We will keep you informed of our progress and target fix timeline.
We will credit you publicly if you'd like recognition after the issue is resolved.
We will work with you on a coordinated disclosure timeline (typically 30 days from fix deployment).

Scope

In scope

verbospilot.com and subdomains
app.verbospilot.com
Authentication and session security
Webhook ingestion endpoints
API endpoints (/api/*)
Privilege escalation
Data exposure / IDOR
XSS and injection vulnerabilities

Out of scope

Denial of service attacks
Social engineering of staff
Physical security
Automated scanning without prior permission
Third-party services we don't control
Issues requiring unlikely user interaction
Self-XSS
Missing rate limits on non-auth endpoints

What We Ask of You

Do not access, modify, or delete data that isn't yours
Do not perform testing that could degrade service for other users
Do not exfiltrate data to prove impact — a minimal proof of concept is sufficient
Give us reasonable time to remediate before public disclosure
Provide enough detail that we can reproduce and validate the issue

What to Include in Your Report

Affected URL(s) and HTTP method
Step-by-step reproduction instructions
Impact assessment — what could an attacker do?
Proof of concept (screenshot, request/response, or script)
Your contact information and preferred disclosure credit (optional)

Bug Bounty

We do not currently operate a paid bug bounty program. We offer public acknowledgement and a heartfelt thank you. We review this policy annually and may introduce bounties in the future.

Submit a Report

Report a vulnerability

Send your report by email. Include as much detail as possible. Please do not submit vulnerability reports through public channels (GitHub issues, Twitter, etc.).

Email [email protected]

PGP key available on request · Response within 48 hours