Vulnerability disclosure
Found a security problem? Tell us, and here is what happens next.
We would rather hear about a security problem from you than read about it somewhere else. If you have found a vulnerability in a Veridatum system, this page tells you how to tell us and what we will do about it.
How to report
Email security@veridatum.co.uk. Tell us what you found, where, and enough detail for us to reproduce it — a proof of concept, a request and response, or a short screen recording all help. Please report in English. If you want to encrypt your report, ask us for a key first.
What we will do
We will acknowledge your report within 3 working days and give you an assessment within 10 working days. We will keep you informed while we fix it, and tell you when it is resolved. If we decide not to act on something, we will explain why rather than go quiet.
What we ask of you
Give us a reasonable opportunity to fix the issue before you disclose it publicly. We will agree a timescale with you and we will not ask you to stay silent indefinitely. We will credit you when we publish a fix, unless you would rather we did not.
In scope
veridatum.co.uk and its subdomains, the demonstration environment, and the Veridatum platform application.
Out of scope
Findings from automated scanners without a demonstrated impact; missing security headers or cookie flags with no exploitable consequence; reports of unsupported TLS versions or cipher suites alone; social engineering of our staff or our suppliers; physical attacks; denial of service; and issues in third-party services we do not control, which should go to that provider.
Please do not
Access, modify or delete data that is not yours; degrade or interrupt the service for anyone else; run denial-of-service or brute-force tests; use automated scanning at a volume that affects availability; or use any client document you may encounter for any purpose. If you come across personal data, stop, do not copy it, and tell us immediately.
Safe harbour
If you follow this policy in good faith we will treat your research as authorised, we will not pursue or support any legal action against you for it, and we will work with you if someone else does. This is not a paid bug bounty; we do not offer rewards.