Report a vulnerability

Email admin@verdact.io with the subject "Security report". Include what you found, the page or request involved, and the steps to reproduce it. Please do not put customer data in the first message. The same contact is listed in our security.txt.

• One person runs Verdact. We aim to reply within 3 business days. This is a target, not a service commitment.
• We will tell you whether we can reproduce the issue and when we expect to fix it.
• We do not run a bug bounty and do not pay for reports. If you want credit, say so and we will name you once the issue is fixed.

• www.verdact.io and the app behind it, including sign-in, the dashboard, evidence upload and the public audit and waitlist forms.
• Ways to see another merchant's data, act as another user, or bypass sign-in or consent checks.
• Ways to make Verdact send anything to Stripe or Slack that the merchant did not approve.

• Denial-of-service, volumetric testing, or automated scanning at high volume.
• Social engineering, phishing, or physical attacks.
• Issues in services we do not run, such as Stripe, Slack or our hosting providers. Report those to the provider.
• Missing best-practice headers or settings with no demonstrated impact, and reports that only repeat the output of an automated scanner.

• Access, change or keep data that is not yours. Stop once you have shown the issue.
• Test against real merchants' accounts. Use an account you created.
• Publish details before we have had a reasonable chance to fix the problem.

If you act in good faith and follow this page, we will not pursue a complaint against you for the research. This is a statement of intent by Verdact LLC and does not bind anyone else, such as a provider whose service you test.