We welcome good-faith security research. This policy defines a safe, coordinated path that protects users, evidence and the researcher.
Program active · coordinated disclosureWe confirm receipt and assign a reference when the report contains a reachable contact.
We assess scope, reproducibility and likely severity, then request missing evidence if necessary.
For accepted findings, we share status while investigation or remediation is active.
We agree publication timing and researcher credit. No bounty is promised unless agreed in writing before work.
When research follows this policy, is lawful and is intended to improve security, VENTEX will not initiate legal action solely for that research. If a third party initiates action, we will make our good-faith assessment known where legally permitted.
This policy does not authorise violations of law, privacy, contracts you hold with third parties or access to data beyond what is strictly necessary to demonstrate the issue. Response times are targets, not guarantees.