Responsible Disclosure Policy

Vision Makers Technologies Inc. welcomes reports from security researchers and commits to handling them fairly.

1 · How to report

Email admin@visionmakers.io with subject line "Security, [brief summary]". Include:

• a clear description of the issue and its impact;
• reproduction steps or proof of concept;
• affected URL, contract address or component;
• your assessment of severity;
• how you would like to be credited, if at all.

Encrypted submission: request our PGP key in an initial unencrypted message containing no vulnerability detail.

2 · Our commitments

We will keep you informed, credit you publicly if you wish, and notify you before disclosing.

3 · Safe harbour

If you make a good-faith effort to comply with this Policy, we will not pursue or support legal action against you, and we will make it known that your activity was authorised if a third party pursues action.

This protection applies where you:

• stay within the scope below;
• avoid privacy violations, data destruction and service degradation;
• access only the minimum data needed to demonstrate the issue;
• do not exfiltrate, retain or publish any user data;
• give us reasonable time to remediate before public disclosure;
• do not extort, threaten, or demand payment as a condition of disclosure.

4 · In scope

• The Vision Makers web platform and API
• Vision Makers smart contracts deployed on EVM networks
• The Telegram Mini App and bot
• Mobile applications, once released
• Official Vision Makers infrastructure and domains

5 · Out of scope

• Denial of service, volumetric or stress testing
• Social engineering of staff, users or vendors; physical attacks
• Spam, or findings requiring a fully compromised device
• Third-party services we do not control, including wallets, exchanges and data providers
• Automated scanner output without a demonstrated, exploitable impact
• Missing best-practice headers or configurations with no demonstrated exploit
• Issues in unsupported browsers, or requiring highly improbable user interaction
• Publicly known vulnerabilities within a reasonable patch window

6 · Rules

Do not: access, modify or delete data belonging to anyone else; interrupt or degrade service; use findings for financial gain beyond any bounty we offer; or publicly disclose before we have remediated and agreed timing.

For smart contract issues, test on testnets wherever possible. Do not exploit a live vulnerability to demonstrate it, a proof of concept on testnet, or a written explanation, is sufficient and will be taken seriously.

7 · Rewards

8 · Contact

admin@visionmakers.io: subject line "Security"