--- title: "Security Policy | VertoDigital" description: "How to responsibly report security vulnerabilities on vertodigital.com. We welcome good-faith research and commit to prompt acknowledgement." url: "https://vertodigital.com/security-policy" image: "https://vertodigital.com/images/site/og-default.png" --- > For AI agents: an index of every page on this site is at https://vertodigital.com/llms.txt Vulnerability Disclosure # Found something? Tell us. Effective 9 June 2026 ยท Last updated 9 June 2026 We welcome good-faith security research on vertodigital.com. If you find a vulnerability, this page tells you how to report it and what to expect from us in return. ## Scope The following are in scope for vulnerability reports: - vertodigital.com - all pages and endpoints on the main domain. - mcp.vertodigital.com - the MCP API endpoint. The following are **out of scope**: - Third-party services we use - Google, LinkedIn, HubSpot, Cloudflare, Stripe. - Client systems and infrastructure we manage on behalf of clients. - Missing security headers on third-party scripts loaded by our pages. - Rate limiting on non-sensitive public endpoints. - Social engineering attacks targeting our team. - Theoretical vulnerabilities with no demonstrated impact. 02 How to report ## How to report Email [security@vertodigital.com](mailto:security@vertodigital.com). A useful report includes: - A description of the vulnerability and its potential impact. - Step-by-step instructions to reproduce it. - Screenshots, URLs, or proof-of-concept code where relevant. - Your name or alias - anonymous reports are welcome. The more detail you provide, the faster we can act. You don't need to have a complete exploit - if you've found something that looks off, send it through and we'll investigate. 03 What we commit to ## What we commit to - Acknowledgement within 48 hours - we'll confirm receipt on the next business day, two at most. - Resolution target of 30 days for critical issues - we'll keep you updated on progress and let you know if we need more time. - Safe harbour - we will not pursue legal action against researchers who act in good faith under this policy. - Credit - if you'd like to be acknowledged for your find, we'll credit you when we disclose or document the fix. - No surprises - we'll tell you when the issue is fixed and coordinate any public disclosure with you. 04 Good faith guidelines ## Good faith guidelines To keep this a safe harbour for both sides, we ask that you: - Give us reasonable time to resolve the issue before any public disclosure. - Avoid accessing, modifying, or deleting data that isn't yours. - Do not run automated scanners or denial-of-service tests against our infrastructure. - Do not use findings to access client data or third-party systems. Research that stays within these boundaries qualifies for safe harbour. If you're unsure whether something you're doing is in scope, email us first - we'd rather answer the question than have you hold back a real find. For any question about this policy: [security@vertodigital.com](mailto:security@vertodigital.com).