Responsible disclosure
Start a vulnerability report through the security review form . Describe the affected component and suspected impact at a high level. Keep sensitive evidence out of the form.
Do not include credentials, customer data, working exploit details, or other sensitive evidence in the public form.
Before testing
Testing a VeriProof-managed or customer environment requires written authorization for the exact target and activity. Normal product access does not authorize security testing.
The authorization should identify:
- hostnames, APIs, tenants, and accounts in scope;
- approved source addresses, methods, volume, and dates;
- excluded systems and third-party services;
- stop conditions and an immediate contact; and
- evidence handling and cleanup requirements.
Prepare the evidence
Wait for the security team to provide a protected channel before sending reproduction details. Prepare:
- affected component and version;
- required account or configuration state;
- clear reproduction steps;
- observed and expected behavior;
- potential impact and affected boundary; and
- redacted supporting evidence.
Stay within the written test scope and stop once you have enough evidence to demonstrate the finding. Do not access, change, or delete unauthorized data.
Third-party services
Use the provider’s disclosure program for vulnerabilities in Azure, Solana, or another third-party service. Report defects caused by VeriProof configuration or code through VeriProof’s process.