Report a security finding

Coordinated disclosure for researchers, customers, and partners. Last updated: September 29, 2026

How to report

If you believe you have found a security vulnerability in Valkit, please email [email protected]. Please do not open a public issue, post on social channels, or use general support channels for vulnerability reports.

What to include

Helpful reports usually include:

Summary — what the issue is, in plain language
Steps to reproduce — clear steps, URLs, and accounts involved (use test data only)
Impact — what an attacker could do if abused
Environment — browser, OS, or other relevant details
Proof of concept — screenshots, request/response samples, or a minimal demo when safe to share

Please do not

Access or modify data that is not yours
Disrupt service, run denial-of-service tests, or spam accounts
Social-engineer customers, partners, or Valkit staff
Exfiltrate large amounts of data to prove a finding — a small sample is enough
Publicly disclose the issue before we have had a reasonable chance to investigate and remediate

What to expect

We aim to acknowledge reports within 1 business day, share a status update within 3 business days, and work toward remediation as quickly as the severity allows (often within 30 days for confirmed issues).

We do not currently run a paid bug bounty program. We still appreciate good-faith research and will work with you on coordinated disclosure when a report is valid.

Safe harbor

If you research in good faith, stick to the limits above, and report findings promptly to [email protected], we will not pursue legal action for that research. This does not authorize access to customer data, criminal activity, or anything outside Valkit systems you are testing.