Contact: mailto:security@hybrd.com
Expires: 2028-01-01T00:00:00.000Z
Preferred-Languages: en

# Vulnerability Disclosure Program
#
# We welcome good-faith reports from security researchers. To be eligible:
#
# - Reports must include clear evidence of exploitability, not just scanner output
# - Do not submit unvalidated automated scanner output
# - Findings must affect Hybrd's own systems or code
# - You must not demand or accept compensation in exchange for disclosure
# - You must not access, modify, or exfiltrate user data beyond what is
#   necessary to demonstrate the vulnerability
# - You must not conduct social engineering, denial-of-service, or
#   physical security testing
# - You must not disclose publicly before we have had a chance to remediate
#
# When reporting, please include "VDP" in your email subject line and
# describe the vulnerability, where you found it, reproduction steps,
# and its potential impact.
# Include your LinkedIn profile URL.
#
# We commit to acknowledging valid reports within 72 hours and will not
# pursue legal action against researchers acting in good faith.