Responsible Disclosure

This policy applies to security vulnerabilities in Vulnara itself - our web application (vulnara.io), API (api.vulnara.io), and browser extension.

This policy is not for reporting vulnerabilities you discover in third-party systems using Vulnara as a scanning tool. For that, contact the affected organization directly or submit through their bug bounty program.

• vulnara.io and all subdomains (app.vulnara.io, api.vulnara.io)
• The Vulnara Chrome extension
• Authentication and authorization issues (account takeover, privilege escalation)
• Data exposure - access to other users' scan data, findings, or credentials
• Injection vulnerabilities in the Vulnara platform itself (XSS, SQLi, SSRF)
• Insecure direct object references in Vulnara's own API
• Sensitive data exposure (API tokens, credentials visible in responses or logs)

• Vulnerabilities in third-party services we use (Stripe, cloud providers)
• Denial of service attacks
• Social engineering of Vulnara staff
• Physical attacks against our infrastructure
• Issues that require unlikely user interaction (self-XSS)
• Missing security headers with no demonstrable impact
• Rate limiting on non-sensitive endpoints
• Vulnerabilities in systems you do not have permission to test

Email your report to security@vulnara.io with the subject line Security vulnerability report.

Please use PGP encryption if you are sending sensitive details. Our PGP key is available at vulnara.io/.well-known/pgp.asc.

We will acknowledge receipt within 48 hours and provide a status update within 7 days.

A useful report includes:

• A clear description of the vulnerability and its potential impact
• The URL, endpoint, or component affected
• Step-by-step reproduction instructions
• Screenshots, HTTP request/response examples, or a proof-of-concept
• The conditions needed to trigger the issue (authenticated, specific role, etc.)

If you follow this policy and report in good faith, we will:

• Not pursue legal action against you for the discovery and reporting
• Work with you to understand and reproduce the issue
• Prioritise fixing critical and high-severity issues within 30 days
• Keep you informed on the status of the fix
• Credit you in our security acknowledgements (unless you prefer to remain anonymous)

We do not currently operate a paid bug bounty program, but we will acknowledge all valid, responsibly disclosed reports and may offer recognition or swag at our discretion.

To keep this a safe process for everyone:

• Only test against your own Vulnara account and data
• Do not access, modify, or delete data belonging to other users
• Do not disclose the vulnerability publicly until we have resolved it (or until 90 days have passed with no response from us)
• Do not exploit the vulnerability beyond what is needed to demonstrate it
• Do not use social engineering, phishing, or physical attacks

For general support or non-security issues, use our contact page instead.