Vera AI · Security

Responsible disclosure

Report a vulnerability security.txt Security overview

Found something? Tell us. We welcome good-faith security research. This page is the policy behind our security.txt: how to report, what we commit to, the safe harbor we extend, and what is out of scope.

Acknowledgment within 3 business days

Safe harbor for good-faith research

Bounty none today

Contact info@vendorbenchmark.com

THE SECURITY REVIEW Security overview Security and data FAQ Data processing addendum Subprocessors Trust center Responsible disclosure Security review package Security and data review guide (PDF)

01 · HOW TO REPORT

One email, four things in it.

Email info@vendorbenchmark.com with the subject line “Security report”.

•What you found

•The steps to reproduce it

•The URL or endpoint involved

•The impact you believe it has

A proof of concept helps; access to another customer's data does not need to be proven beyond the first record.

02 · WHAT WE COMMIT TO

Four commitments.

•We acknowledge reports within 3 business days

•We keep you informed while we investigate, and tell you when the issue is fixed

•We do not run a paid bounty program today

•We credit researchers who want credit, and we say thank you properly

03 · SAFE HARBOR

Research within this policy is welcome.

We will not pursue legal action for research that stays within this policy.

•Act in good faith

•Access only what is needed to demonstrate the issue

•Do not read or modify other customers' data beyond the minimum proof

•Do not degrade the service

•Give us reasonable time to fix the issue before any public disclosure

04 · OUT OF SCOPE

What we do not accept as a report.

•Denial of service and volumetric testing

•Social engineering of our staff or customers

•Physical attacks and attacks on third-party services we use

•Reports from automated scanners without a demonstrated impact

05 · WHERE TO LOOK FIRST

The isolation boundary is the crown jewel.

The security overview describes the architecture. If you find a way across the tenant boundary, we want to know the same day.

•Database-enforced tenant isolation

•Signed short-lived downloads

•Audit logging

SECURITY.TXT

The machine-readable policy lives where researchers look.

Our RFC 9116 security.txt names this policy and the contact address, and expires one year out so it is never stale. Security is owned by Fredrik Filipsson, founder, at info@vendorbenchmark.com.

Open security.txt →