We are a security company, and we hold ourselves to the standards we ask of our clients. If you have found a vulnerability in our systems, we want to hear about it.
Last updated: 27 October 2026
How to report
Email security@v1olet.xyz. If your report contains sensitive data or credentials, contact us first to arrange a secure way to share it. Our contact details are also published in security.txt.
A helpful report includes:
- the affected system or URL;
- a description of the issue and its likely impact;
- clear steps to reproduce it, or a proof of concept;
- how you would like to be credited, if at all.
Scope
This policy covers v1olet.xyz and the subdomains operated by V1olet Security. It does not cover our clients' systems. If you find a vulnerability in a client's systems, please report it to that organisation directly.
Please do
- Give us reasonable time to investigate and fix the issue before you disclose it publicly.
- Use only the minimum access needed to demonstrate the issue, and stop as soon as you have.
- Delete any data you obtained, and do not share it.
Please do not
- Run denial-of-service tests or anything that degrades our services.
- Access, modify or delete data that does not belong to you.
- Use social engineering, phishing or physical attacks against our staff or premises.
- Run automated scanners at a volume that affects other users.
What you can expect from us
- We will acknowledge reports within two days.
- We will keep you informed while we investigate and fix the issue.
- With your permission, we will credit you once the issue is fixed.
- We will not take legal action against anyone who reports a vulnerability in good faith and in line with this policy.
We do not currently run a paid bug bounty programme.