Vulnerability disclosure policy

This policy covers vapentest.com, the VApentest application, and infrastructure we operate. Do not test customer targets or third-party systems unless you own them or have written authorization.

Send a description, affected URLs or versions, and steps to reproduce to security@vapentest.com. Do not include exploit payloads against production beyond what is needed to show impact.

We aim to acknowledge reports within a few business days and to keep you updated while we investigate. Please give us a reasonable window to fix issues before public disclosure (90 days is a typical default unless we agree otherwise).