1. How to report
Email security@vatan.one. The same address is published in our security.txt file.
2. What to include
What you found and where, the steps to reproduce it, and what someone could do with it. A request id from a response header helps.
3. What is in scope
vatan.one, console.vatan.one, api.vatan.one and gateway.vatan.one.
4. What we ask of you
Access only as much as you need to show the issue, and no other customer's data beyond that.
No denial of service, no spam and no social engineering of people or suppliers.
Give us reasonable time to fix the issue before you disclose it.
5. What we do
We acknowledge your report. We will keep you updated until it is closed, and we do not pursue researchers acting in good faith under this policy. There is no bug bounty or reward.