Responsible disclosure policy

1. Scope

In scope:

• The Vardum app for iOS.
• The Vardum relay servers and their ciphertext handling.
• The messaging protocol itself: the handshake, the ratchet and the group key agreement.
• Identity, session and credential handling, including anything that lets one account reach another account's data.
• This website, including the Apple app-link file it serves.

Out of scope:

• Third-party services we don't operate, such as Apple's App Store, TestFlight and push notifications.
• Social engineering of our team or users, and physical attacks.
• Denial of service by volume, and rate-limit or spam bypass with no security impact.
• Automated scanner output with no working proof of concept.
• Anything that needs a jailbroken device to reach data the App is protecting.

We care most about the confidentiality of message content and key material, the integrity of the handshake and ratchet, and any authentication bypass. If you're unsure whether something counts, tell us anyway.

2. How to report

Email support@tryveil.app with what you found and its impact, steps to reproduce and the affected build if you know it, any proof of concept, and whether and how you'd like to be credited.

Please never include real conversations, keys or another person's identity material in a report.

3. Encrypted reports

Encrypted reports are welcome. To get our public key before you write anything sensitive, email support@tryveil.app with the words "key request" and no other detail; we'll reply with the key and its fingerprint. If you need a different secure channel, say only that in a first email and we'll arrange one. Never put the finding itself in an unencrypted first contact.

4. Safe harbour

If you make a good-faith effort to follow this policy, we will not pursue or support legal action against you over your research, and we'll say so publicly if anyone else tries to. Good faith means you test only accounts you own and only your own data; you don't access, modify, keep or share anyone else's data; you don't degrade the service for others; you don't use social engineering, phishing or physical intrusion; you give us reasonable time to fix the issue before disclosing it; and you comply with the law that applies to you. This commitment binds only us.

5. Recognition, not a bounty

We don't run a bug bounty, and we won't pretend otherwise. Vardum is funded by its users, not by advertising, and there's no bounty budget to promise. (The separate $1,000 public challenge has its own rules.) With your permission we'll credit you in the release notes when a fix ships, and we will never present your work as ours.

6. Disclosure timeline

• Within 3 business days we acknowledge your report.
• Within 10 business days we give you an initial assessment, including severity and whether we can reproduce it.
• We aim to ship a fix and agree a coordinated disclosure date within 90 days of your report.
• If a fix genuinely needs longer, we'll tell you why and agree a new date rather than let the deadline pass quietly.

When a fix ships we publish a short advisory and credit you unless you've asked us not to. If you stop hearing from us, escalate in the same thread: a missed deadline is our failure, not a reason for you to stay silent.

7. What we will not do

• Ask you to sign a non-disclosure agreement as the price of reporting.
• Threaten legal action to keep a report quiet.
• Ask you to delete your notes or proof of concept.
• Take credit for work you did.

8. Contact

Security reports and questions: support@tryveil.app. Every security claim we make is published at its true status in the claims register, the honest companion to this page.