Report a vulnerability

E-mail support@vryne.com with the subject “Security”. Helpful details: the address concerned, a short description, steps to reproduce and the possible impact. Please do not read personal data of others, and do not change or delete anything.

We confirm receipt within three working days and give a timetable. Confirmed critical issues are fixed first; if you want the report published, we agree the wording with you after the fix.

In scope: vryne.com, the application and the API. Out of scope: vulnerabilities in third-party providers without impact on Vryne, spam, social engineering, denial-of-service tests and automated scanner reports without a reproducible path.

For good-faith research within this page we will not take legal action, as long as you do not read, change or delete data, do not take over other people’s accounts and give us time to fix the issue.

No tests against real customer data or someone else’s account, no load tests, no mail to third parties in Vryne’s name. A report that crosses one of these lines does not help us.

The same details are available as security.txt under RFC 9116 — for scanners and security teams that read it automatically.

https://vryne.com/.well-known/security.txt