Vulnerability disclosure policy

How to report

Email [email protected] with "Security" in the subject. Include what you found, where, the steps to reproduce it, and what an attacker could do with it. Please do not include real personal data or real secrets; describe them instead. We reply within 3 business days.

Where to test

The Vrymdor™ Arena is the only place to test attacks. Its AI Rivals and your ideas run against an isolated copy of the AI Node, with fake values only. Send your idea there, and report a real vulnerability privately to the address above.

What we ask

• Never test against production, customer accounts or real data. Use the Arena and the fake keys it gives you.
• Do not access, change or delete other people's data, and stop as soon as you reach data that is not yours.
• Do not run denial of service tests, spam, social engineering or physical attacks.
• Give us a reasonable time to fix the issue before you share it publicly.

What we promise

• We confirm we received your report and keep you updated until it is fixed.
• We credit you when the fix ships, if you want to be named.
• Good-faith research that follows these rules won't face legal action from us.

In scope

vrymdor.com, app.vrymdor.com, the hosted AI Node, the n8n node n8n-nodes-vrymdor, and the Arena at app.vrymdor.com/arena.