Vulnerability disclosure policy

Veritome is committed to the security of our platform and the data our customers entrust to us. We welcome and encourage responsible security research and vulnerability disclosure from the security community. This policy sets out how to report vulnerabilities and what you can expect from us.

This policy applies to vulnerabilities in:

• The Veritome web application (app.veritome.eu)
• Veritome REST APIs (app.veritome.eu/api)
• The Veritome public website (veritome.eu)
• Supporting infrastructure directly operated by Veritome

Out of scope: third-party services (Stripe, Mistral, Hetzner, Resend, Sentry, PostHog), social engineering, denial-of-service attacks and physical security.

When reporting a vulnerability, please include:

• A clear description of the vulnerability and its potential impact
• Detailed steps to reproduce the issue
• The affected component (URL, API endpoint, feature)
• Your assessment of severity (critical / high / medium / low)
• Any proof-of-concept code or screenshots

For sensitive reports, you may encrypt your message with our PGP key at https://veritome.eu/.well-known/pgp-key.asc

We recognise security researchers who help us protect our platform and our customers. With your permission, we will acknowledge your contribution on this page. We do not currently offer a monetary bug bounty programme, but may introduce one in the future.

This policy is maintained with reference to Article 11 of the Cyber Resilience Act (EU) 2024/2847, which requires manufacturers of products with digital elements to establish and maintain a coordinated vulnerability disclosure policy. Actively exploited vulnerabilities will be reported to ENISA within 24 hours as Article 14(2)(a) requires.