> For the complete documentation index, see [llms.txt](https://docs.visionmakers.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.visionmakers.io/legal/responsible-disclosure.md).

# Responsible Disclosure Policy

Version 2.0 · Effective 24 October 2026

**Vision Makers Technologies Inc.** welcomes reports from security researchers and commits to handling them fairly.

## 1 · How to report

Email [admin@visionmakers.io](mailto:admin@visionmakers.io) with subject line **"Security, [brief summary]"**. Include:

- a clear description of the issue and its impact;
- reproduction steps or proof of concept;
- affected URL, contract address or component;
- your assessment of severity;
- how you would like to be credited, if at all.

Encrypted submission: request our PGP key in an initial unencrypted message containing no
vulnerability detail.

## 2 · Our commitments

| Stage | Target |
| --- | --- |
| Acknowledgement | **2 business days** |
| Initial triage and severity assessment | **5 business days** |
| Status updates | At least every **10 business days** |
| Remediation target, critical | **7 days** |
| Remediation target, high | **30 days** |
| Remediation target, medium / low | **90 days** |

We will keep you informed, credit you publicly if you wish, and notify you before disclosing.

## 3 · Safe harbour

If you make a good-faith effort to comply with this Policy, we will **not pursue or support legal
action against you**, and we will make it known that your activity was authorised if a third
party pursues action.

This protection applies where you:

- stay within the scope below;
- avoid privacy violations, data destruction and service degradation;
- access only the minimum data needed to demonstrate the issue;
- **do not exfiltrate, retain or publish** any user data;
- give us reasonable time to remediate before public disclosure;
- do not extort, threaten, or demand payment as a condition of disclosure.

## 4 · In scope

- The Vision Makers web platform and API
- Vision Makers smart contracts deployed on EVM networks
- The Telegram Mini App and bot
- Mobile applications, once released
- Official Vision Makers infrastructure and domains

## 5 · Out of scope

- Denial of service, volumetric or stress testing
- Social engineering of staff, users or vendors; physical attacks
- Spam, or findings requiring a fully compromised device
- Third-party services we do not control, including wallets, exchanges and data providers
- Automated scanner output without a demonstrated, exploitable impact
- Missing best-practice headers or configurations with no demonstrated exploit
- Issues in unsupported browsers, or requiring highly improbable user interaction
- Publicly known vulnerabilities within a reasonable patch window

## 6 · Rules

**Do not**: access, modify or delete data belonging to anyone else; interrupt or degrade service;
use findings for financial gain beyond any bounty we offer; or publicly disclose before we have
remediated and agreed timing.

For smart contract issues, test on **testnets** wherever possible. Do not exploit a live
vulnerability to demonstrate it, a proof of concept on testnet, or a written explanation, is
sufficient and will be taken seriously.

## 7 · Rewards

<div class="callout">
<span class="callout-label">Programme terms to confirm</span>
A formal bug bounty with published severity bands and reward amounts should be established and
documented here. Until then, rewards are discretionary and assessed case by case on severity,
report quality and impact. State clearly whether a programme is live before researchers rely on
it.
</div>

## 8 · Contact

[admin@visionmakers.io](mailto:admin@visionmakers.io): subject line "Security"