Pre-incorporation notice. Venoly is run by its two founders and operated from Emmen, the Netherlands (the co-founder is based in the United States), while the legal entity (a Dutch B.V.) is being incorporated. Contracts and liabilities referenced in these documents are entered into by the founder personally until incorporation completes, at which point they transfer to Venoly B.V. by novation without action required from you. Where the documents refer to Venoly B.V., that name should be read as "Venoly (operating as a sole proprietorship pending incorporation)" until the entity is registered with the Dutch Chamber of Commerce (KvK).

1. Safe-Harbor Promise

If you act in good faith under the rules below, we will:

Not pursue legal action against you under the Dutch Computer Crime Act (Art. 138ab Sr) or the EU Cybersecurity Act.
Not refer your activity to law enforcement or to your university, employer, or any registry.
Treat your report as authorized testing — meaning your access was permitted, not unauthorized intrusion.
Credit you publicly if you want it (and only if you want it).

This safe harbor applies only to the scope, rules, and disclosure timeline described below. Activity that exceeds the scope or rules is not protected.

2. In Scope

The following Venoly-controlled properties are in scope:

venoly.nl, www.venoly.nl, app.venoly.nl
api.venoly.nl
panel.venoly.nl
blog.venoly.nl, developer.venoly.nl, support.venoly.nl, status.venoly.nl
The Venoly Android app (package com.venoly.app) — the current release from venoly.nl/download.
The Venoly desktop app (Windows installer and AppImage from venoly.nl/download) — current release.

We particularly value reports about:

Authentication, session, and token handling.
Authorization across servers, channels, DMs, and admin scopes.
SSRF, RCE, SQL injection, XSS, CSRF.
Captcha and rate-limit bypass.
Privacy / data-exposure issues, including subject-access export leakage.
Defects in Venilator policy evaluation that allow circumvention of platform policies.

3. Out of Scope

Denial-of-service attacks, volumetric or otherwise. (You may simulate at low volume — <10 req/s — and stop on first sign of impact.)
Social engineering of Venoly staff or contractors.
Physical security of our office or any data center.
Third-party infrastructure — Cloudflare, Vercel, Stripe, LiveKit, Firebase, etc. Report those to the respective vendor under their own programs.
Reports concerning outdated software versions with no demonstrated impact.
Self-XSS, missing security headers without demonstrated exploitation, clickjacking on unauthenticated marketing pages.
Spam-prevention or rate-limit reports below the "working exploit" bar.
Findings already reported by another researcher.

4. Rules of Engagement

Only test with accounts you own. Do not access or modify other users' data.
Don't exfiltrate more data than is needed to prove the vulnerability. A single record or a screenshot is fine; whole-table dumps are not.
Stop immediately and report if you discover what looks like child sexual abuse material, terrorist content, or active criminal activity.
Don't disclose publicly until we've had time to fix and you've agreed on a coordinated disclosure date.
Don't install backdoors, leave persistent test accounts, or modify configuration.
Comply with all applicable law. Safe harbor is contractual; it does not override criminal statutes for conduct that exceeds these rules.

5. How to Report

Email security@venoly.nl. There is no PGP key yet. If a report holds credentials or exploit details you would rather not send in clear text, say so in the email and we will arrange a channel first. Our contact record is /.well-known/security.txt.

Please include:

A short description of the vulnerability.
Reproduction steps, including URLs and any test account ID you used.
Your suggested severity and a proof-of-concept (PoC) where possible.
How you would like to be credited (or that you prefer to remain anonymous).

6. Recognition & Rewards

Venoly is pre-incorporation and pre-revenue at the time of writing. We currently offer:

Public credit on our security page (the "Hall of Fame") with your name or handle.
Aura subscription credits, where applicable.
A handwritten thank-you note, for the heroic finds.

Monetary bounties will be introduced once the legal entity is operational; researchers in the Hall of Fame will be eligible for retroactive payment at our discretion if the report would otherwise have qualified under the future scheme.

7. Our SLAs

Acknowledgement: within 24 hours.
Initial triage: within 5 business days.
Fix & disclosure window: typically 90 days from acknowledgement; sooner for actively-exploited issues.
Reporter update cadence: at least every 14 days while a report is open.