Vulnerability Disclosure Policy

1. Introduction & Commitment

Security is part of how the Service is built and operated. Vexaro performs regular security testing and operates an information-security program designed and operated to align with the principles of recognised information-security-management, service-organisation-control, and application-security-verification frameworks, as described in the Security Overview. No service is free of vulnerabilities, and we do not represent that ours is; this policy describes the program through which we receive and act on security reports, not an outcome or a guarantee of security.

We welcome reports from security researchers and from anyone who discovers a potential vulnerability in Vexaro’s own systems. We are committed to working with reporters in good faith, to investigating valid reports, to fixing confirmed issues, and to handling disclosure in a coordinated way. This policy sets out how to report, what we ask of you, and what you can expect from us.

2. Scope

In scope. This policy covers vulnerabilities in Vexaro’s own systems and products, including:

• the Vexaro-operated Service: the control plane (API, dashboard, signaling), the relay, and supporting backend services;
• Vexaro’s public websites and the Legal Center and Trust Center; and
• the Vexaro Products and the Vexaro Agent software (Desk, Mesh, and the related clients and components).

Out of scope. The following are not authorised under this policy and must not be tested:

• third-party services, vendors, and Subprocessors, including the systems of the providers Vexaro uses (report issues in those to the relevant provider, and do not test them);
• social engineering of Vexaro personnel, Customers, or users (including phishing, pretexting, and physical or telephone-based attempts);
• physical attacks against Vexaro facilities, staff, or equipment;
• denial-of-service (DoS/DDoS), volumetric, resource-exhaustion, or other availability-degrading testing;
• automated scanning that generates excessive traffic, spam, or load; and
• any Customer tenant, account, deployment, or data that you do not own or are not explicitly authorised to test (Section 7).

Findings that depend only on missing best-practice hardening with no demonstrable security impact (for example, the absence of a particular header without a working exploit) may be acknowledged but are generally treated as informational.

3. How to Report

Send security reports to [email protected].

To help us triage and reproduce the issue quickly, please include:

• a clear description of the vulnerability and the steps to reproduce it;
• the impact: what an attacker could do, and any preconditions;
• the affected asset or version (for example, the URL, endpoint, Product, or Agent version);
• any proof-of-concept, request/response samples, logs, or screenshots that demonstrate the issue; and
• how you would like to be credited, if you wish to be (Section 6).

Encryption option. If you wish to send sensitive details encrypted, current reporting details and any available encryption key are published in our security contact file at vexaro.cloud/.well-known/security.txt (Section 8). Please do not include unnecessary Customer or End-User Personal Data in your report; describe the issue with the minimum data needed to demonstrate it.

4. Safe Harbour

If you make a good-faith effort to comply with this policy during your security research, we will consider that research to be authorised, and we will not pursue or support legal action against you in connection with it. We will work with you to understand and resolve the issue quickly, and we will recognise that your activity was carried out under this policy.

This safe harbour applies only where you:

• act in good faith and stay within the scope of this policy (Section 2);
• do not violate the privacy of Customers, End Users, or others, and access only the minimum data necessary to demonstrate a vulnerability;
• do not destroy, alter, exfiltrate, or retain data that is not your own, and delete any such data you encounter as soon as it is no longer needed to demonstrate the issue;
• do not degrade, disrupt, or damage the Service or its availability (no DoS, no resource exhaustion, no spam);
• do not test Customer tenants or data you do not own or are not authorised to test (Section 7), and do not pivot from a vulnerability into accessing such data;
• give us reasonable time to investigate and remediate before any disclosure (Sections 5 and 6); and
• comply with applicable rules and with the Acceptable Use Policy.

If you are unsure whether a specific action is authorised, contact us at [email protected] before proceeding. This safe harbour is a statement of how we will treat good-faith research under this policy; it does not bind any third party, and it does not authorise activity against assets that are out of scope.

5. Our Commitments

When you report a vulnerability under this policy, you can expect us to:

• acknowledge receipt of your report within a reasonable period after we receive it;
• triage and validate the report, assess its severity and impact, and let you know whether we have confirmed it;
• keep you reasonably informed of our progress as we investigate and remediate, and ask you for clarification where we need it; and
• work toward remediation and coordinated disclosure within a reasonable, risk-based timeline. We aim to resolve confirmed issues promptly, prioritising by severity, and to coordinate timing with you.

These are commitments about how we run the program. They describe a reasonable target for how we respond and disclose; they are not a fixed or guaranteed timeframe, and the time to remediate a given issue depends on its severity, complexity, and the systems involved.

6. Coordinated Disclosure

We ask that you give us a reasonable amount of time to investigate and remediate a reported vulnerability before disclosing it publicly or to any third party, and that you coordinate the timing of any disclosure with us. This protects Customers and End Users while a fix is prepared and deployed.

We support coordinated disclosure and are happy to work with you on timing and on any advisory. Where you would like recognition, we will credit reporters who wish to be credited for valid reports, by mutual agreement on the wording and timing. If you would prefer to remain anonymous, we will respect that.

Reporting to authorities. Where the EU Cyber Resilience Act applies to a Vexaro app, Vexaro notifies an actively exploited vulnerability in it, and a severe incident that affects its security, through the single reporting platform to the competent CSIRT and to ENISA: an early warning within 24 hours of becoming aware of it, a notification within 72 hours, and a final report within 14 days after a fix or mitigation is available, or, for an incident, within one month. Vexaro also tells the affected users, and where appropriate all users, about the issue and the steps they can take. A vulnerability reported under this policy can be part of such a notification; we do not name the reporter without their agreement.

7. Out of Scope / Not Authorised

To be explicit about the boundary of authorisation under this policy:

• Testing Customer tenants, accounts, deployments, or data that you do not own or are not explicitly authorised to test is not authorised under this policy. This policy covers Vexaro’s own systems (Section 2); it does not grant any right to access or test another party’s data or instance.
• Any activity that would violate the Acceptable Use Policy is not authorised, even if it touches an in-scope asset. This includes unauthorised access to accounts or data, deploying malicious code, denial-of-service, or circumventing controls beyond what is necessary to demonstrate a specific vulnerability.
• Engagement-based security testing of third-party or Customer systems is a separate matter handled under a written Statement of Work and rules of engagement (see the Acceptable Use Policy); it is not conducted under this policy.

Activity that falls outside this policy is outside its safe harbour and may be handled as an Acceptable Use Policy or Terms of Service matter, and, where warranted, reported to a competent authority.

8. Contact

Report security vulnerabilities in Vexaro’s own systems to:

• Security reports / vulnerability disclosure: [email protected]

Our security contact file, with current reporting details and any encryption key, is published at vexaro.cloud/.well-known/security.txt.

For other matters, write to:

• Abuse reports: [email protected]
• Legal and contracting: [email protected]
• Support: [email protected]

Contracting and notice details are provided on invoices and Order Forms.

This document is part of the Vexaro Legal Center.