Responsible Disclosure Policy
Effective date: 10 October 2026.
Report a vulnerability
Email [email protected]. Include a description, the affected component and version, steps to reproduce, and the impact you believe it has. If you need to send details encrypted, say so in your first message and we will arrange a secure channel. Our contact details are also published at /.well-known/security.txt.
Scope
- The Ward browser extension.
- The Ward control plane: extension API, management API and admin console.
- This website.
Out of scope: denial-of-service testing, social engineering, physical attacks, findings in third-party services (such as Microsoft Entra ID or browser extension stores) — please report those to their owners — and reports from automated scanners without a demonstrated impact.
Rules for good-faith research
- Test only against your own organisation or test accounts. Never access, modify or keep other people’s data; if you encounter it, stop and tell us.
- Do not degrade the service for others.
- Give us reasonable time to fix the issue before disclosing it publicly. We will agree a disclosure date with you.
Safe harbour
If you act in good faith and follow this policy, we will not pursue or support legal action against you for your research, and we will work with you to understand and fix the issue.
What to expect
- An acknowledgement within 3 business days.
- An assessment and, where we confirm the issue, a fix and regular updates on progress.
- Public credit once the issue is fixed, if you would like it.
- Rewards: Valvayn does not currently offer monetary rewards for vulnerability reports. Researchers who report responsibly are credited with their permission..