We take the security of Velorith and of our customers' data seriously. If you believe you have found a security vulnerability, we want to hear about it. This policy explains what is in scope, how to report a vulnerability, what we expect from you and what you can expect from us.
1. How to report
Please send your report by email to [SECURITY_EMAIL]. We accept reports in English and German. A good report contains
- a description of the vulnerability and the affected component, address or app version,
- the steps needed to reproduce it, ideally with a proof of concept,
- the impact you expect, for example which data or functions an attacker could reach, and
- how we can reach you for questions, and whether and under which name you would like to be credited.
Please do not include more personal data or customer content in your report than is needed to show the issue. If you need to share sensitive details, say so in your first message and we will agree on a secure way to exchange them.
2. Scope
This policy covers the systems that we operate for Velorith, in particular
- the website and web app at getvelorith.com and its subdomains,
- our backend functions and APIs used by the web, desktop and mobile apps,
- the agent runtime, including the isolation between members, companies and their agents,
- the workspaces and company brain servers that we operate for customers, as far as you test them with your own company,
- the Velorith desktop and mobile apps that we publish, and
- weaknesses in how agents are controlled, for example ways to bypass approval rules, the emergency stop or spending limits, or to make an agent access data of another member or company, including through prompt injection.
3. Out of scope
The following are not covered by this policy.
- Services of third parties that we use, such as our hosting, model and payment providers listed on our subprocessors page. Please report vulnerabilities in their services to them directly. If a vulnerability in such a service affects Velorith specifically, you are welcome to tell us as well
- Websites and services that customers connect or that agents visit
- Incorrect, harmful or biased model output and jailbreaks of a model without a security impact on Velorith or its customers. Please report such content as described in our AI transparency information
- Denial of service and load testing, spam and social engineering of our staff or customers, and physical attacks
- Results of automated scanners without a demonstrated impact, missing security headers or best practices without a concrete attack scenario, and self-XSS
- Vulnerabilities that require a compromised device, a rooted or jailbroken phone or an outdated browser
4. Rules for testing
- Test only with accounts and companies that you have created yourself or for which you have the owner's permission
- Do not access, change or delete data of other members, companies or customers. If you reach such data by accident, stop, do not keep a copy and tell us in your report
- Use the smallest possible proof of concept. Do not plant backdoors or keep persistent access
- Do not degrade the service for others, and do not use workspaces or agents to attack third-party systems, as set out in our acceptable use policy
- Keep the vulnerability confidential until we have fixed it or until we have agreed on a disclosure date with you
5. Safe harbour
If you act in good faith and follow this policy, we regard your research as authorised. We will not take legal action against you or report you to law enforcement for it, and we will not suspend your account because of it. If a third party takes legal action against you because of research that complied with this policy, we will make clear that your research was authorised by us. This policy cannot authorise testing of systems that we do not operate. If you are unsure whether a planned test is covered, ask us at [SECURITY_EMAIL] before you start.
6. What you can expect from us
- We confirm receipt of your report within 3 business days
- We give you an initial assessment, including whether we can reproduce the issue, within 10 business days
- We keep you informed about our progress and tell you when the vulnerability is fixed
- We aim to fix vulnerabilities as quickly as their severity requires. Unless we agree otherwise, we ask you to wait 90 days after your report, or until a fix is available if that is sooner, before you disclose details publicly
- If the vulnerability affected personal data, we notify the affected customers and the competent authorities as required by law and by our data processing agreement
7. Recognition
We do not currently run a bug bounty programme and do not pay rewards for reports, unless we have agreed otherwise with you in writing beforehand. With your consent, we name you as the finder when we publish a fix or a security notice.
8. security.txt
Our contact details for security reports are also published in machine-readable form in accordance with RFC 9116 at getvelorith.com/.well-known/security.txt.