Vulnerability Disclosure

Vaario handles contracts that people keep confidential, so we welcome reports from security researchers who act in good faith. This page says how to report, what you may test, and what you can expect from us.

Write to security@vaario.app. Please include:

• what the vulnerability is and the impact you think it has;
• the exact steps to reproduce it;
• the address, endpoint or screen affected.

The web app and API we run at these addresses:

• vaario.app
• api.vaario.app

These are out of scope and must not be tested:

• Our providers' own systems (Amazon Web Services, Supabase, Vercel, Railway, Cloudflare, Resend). Report those to the provider.
• Denial-of-service attacks and load tests.
• Social engineering, phishing or physical attacks on people we work with or our users.
• Output of automated scanners with no demonstrated impact.
• Low-impact findings with no way to exploit them, such as a missing header on its own.

• Use only accounts you own and created for the test.
• Stop as soon as you have shown the problem. Do not read, copy, change or delete other people's data. If you reach some by accident, stop, delete it from your systems and tell us in your report.
• Do not leave a way back in, and do not go further than you need to show the flaw.
• Keep the finding private until we have fixed it. If 90 days pass after your report with no reply and no fix from us, you may publish it, after telling us in writing first.
• Obey the law that applies to you.

If you follow these rules in good faith, we treat your research as authorised. We will not bring legal action against you for it, and we will not ask anyone else to.

We cannot speak for third parties. If your test reaches a provider's systems, that provider decides for itself, and an authority's decisions are its own.

We do not run a reward programme and do not pay for reports. With your agreement we may thank you publicly. Demanding payment or other benefit in return for a report, or threatening to publish it, ends this authorisation.

We will:

• confirm we received your report within five business days;
• tell you whether we accept it as a vulnerability;
• keep you informed about when it will be fixed;
• handle your personal data as the privacy policy describes.