Responsible Disclosure Policy
We welcome good-faith reports that help us protect VOHARI users. Please avoid actions that create risk for customers, sellers or the platform.
1. Good-faith research
Do not access more data than necessary to demonstrate a vulnerability, alter or destroy user information, perform denial-of-service testing, send spam, use social engineering, disrupt marketplace operations, or retain personal information obtained during testing.
2. Reporting
Provide a clear description, affected URL/component, reproduction steps, expected impact and any supporting screenshots or request samples that do not expose unnecessary personal information. Use the legal/security contact configured on the Legal Information page.
3. Handling
VOHARI will triage credible reports, may ask for clarification, and will work to remediate according to severity and operational risk. Do not publicly disclose an unresolved vulnerability where doing so would materially increase risk to users.
4. No bounty promise
This policy does not create a bug-bounty programme or promise payment. Any reward must be expressly agreed in writing.