What this channel covers
Use this channel to report a suspected vulnerability in the publicly accessible Velocity Ops website and its first-party web routes. Do not assume that a related account, client system, infrastructure host, or third-party service is in scope. This notice does not grant permission to test any system; testing requires prior written authorization from its owner.
Testing boundaries
Do not access, alter, delete, or retain another person's data; disrupt a service; use social engineering; attempt denial of service; establish persistence; or test client and provider systems. Stop if testing exposes information that is not yours and report the minimum detail needed to explain the issue.
This policy does not create a legal safe harbor, promise immunity from legal claims, or change the need for prior written authorization. It does not authorize testing of third-party services linked or embedded on the site.
How to report
Email the affected URL, a concise description of the issue, reproduction steps that do not expose other people's information, the potential impact, and a way to contact you. Do not attach passwords, live tokens, private client data, or unnecessary personal information.
We will review the report and may ask for clarification. We do not promise acknowledgment, remediation, or disclosure deadlines. Please contact us before publicly disclosing details so we can coordinate while any risk remains.