Vulnerability Disclosure Policy

If you've found a security vulnerability in Vyce, we want to hear about it.

How to report

Email security@vyce.io with:

• Where you found it, and how to reproduce it
• What an attacker could do with it
• Any supporting detail — screenshots, logs, proof of concept

What we'll do

• Acknowledge your report within five working days
• Keep you updated on our assessment and fix
• Tell you when it's resolved
• Credit you publicly if you'd like us to

What we ask

• Give us reasonable time to fix the issue before disclosing it publicly
• Don't access, modify or delete data that isn't yours
• Don't degrade our service, and don't run denial of service or automated scanning against production
• Don't use social engineering or physical attacks against our people or offices

Our commitment

If you follow this policy, act in good faith and report promptly, we won't pursue legal action against you.

Out of scope

Automated scanner output with no demonstrated impact, missing security headers with no exploitable consequence, and issues in third-party services we don't control.