Responsible disclosure

How to report

Email security@vallkey.com. Include what you found, how to reproduce it, and its impact as you see it. Encrypt your report with our PGP key if you can; it’s published in security.txt once the domain is live.

What happens next

When	What we do
Within 2 working days	Confirm we have your report
Within 7 days	Tell you how serious we think it is, and our plan
Within 90 days	Fix it, and agree with you when to publish

We credit every reporter who’d like it, in the release notes and our Hall of Fame.

Please

• Don’t access or change other people’s data. Use your own accounts.
• Don’t disrupt the service.
• Give us reasonable time to fix the issue before you publish.