Vulnerability Disclosure Policy

VyPr AI AB operates vyprsec.ai. If you have found a security issue on one of our sites, we would like to hear from you. This page explains what we accept, how to report it, and what protections apply to researchers who follow the rules.

We do not operate a paid bug bounty program. Unsolicited reports will not be compensated with financial rewards or swag.

1. Reporting

Send reports to [email protected] and include:

• the affected site, URL, endpoint or component,
• step by step instructions to reproduce the issue,
• a working proof of concept (see section 4), and
• your assessment of the impact.

You will receive an automated reply confirming receipt. The reply also states that we do not pay for reports. A person will get back to you within five business days.

2. Scope

In scope: web applications and services we operate under vyprsec.ai and its subdomains, for example docs.vyprsec.ai and cve.vyprsec.ai.

Not in scope: services operated for us by third parties, such as Substack or Cloudflare Pages. Report issues in those platforms to the provider.

3. Out of scope

We will not accept reports for:

• missing SPF, DKIM or DMARC records,
• missing security headers such as Strict-Transport-Security, X-Frame-Options or Content-Security-Policy, unless you can demonstrate an exploit that relies on them,
• SSL/TLS configuration details such as cipher preferences, supported protocol versions or certificate chain order, unless you can demonstrate a practical attack,
• server banners, version strings and verbose error pages that do not expose sensitive data,
• missing rate limiting or brute force protection on public forms,
• user enumeration, clickjacking, tabnabbing and self-XSS,
• CSRF on low value actions such as logout.

4. Proof of concept

A report must show the issue in working form. We need reproducible steps that demonstrate an actual exploit, not just an indication that a weakness might exist. Raw output from automated scanners such as Nessus, Acunetix, Burp Scanner, Qualys or nuclei is not a report. We close those submissions without further review.

5. Safe harbor

If you make a good faith effort to follow this policy, we will consider your research to be authorized, we will not pursue legal action against you, and we will work with you to understand and resolve the issue.

This protection does not apply if you:

• access, modify, delete or exfiltrate company or user data. Stop testing as soon as you can show that access is possible, and tell us what you were able to reach,
• run denial of service or DDoS tests, or degrade our servers with high volume automated scanning,
• social engineer, phish or physically attack our team or users,
• demand payment, or threaten to publish findings if we do not pay.

6. Personal data

If you encounter personal data during your research, stop testing immediately, notify us at [email protected], and permanently delete any copies you have made. Retaining or disclosing this data violates this policy and revokes your safe harbor protection.

7. What happens next

We will review your report against this policy and reply. If it contains a valid, reproducible PoC for an issue we consider in scope, we will work on a fix and may ask follow up questions. We do not pay bounties or give rewards, and requests for payment will close the report.

Please give us reasonable time to fix an issue before disclosing it publicly, and do not publish details without our written approval.

8. Governing law

This policy is governed by the laws of Sweden. Disputes arising in connection with it are subject to the exclusive jurisdiction of the courts of Sweden.