We welcome coordinated disclosure from security researchers.
1. Scope
- *.varyom.com web properties.
- Public smart contracts deployed by the Foundation on BNB Smart Chain.
- Public APIs and backend functions.
2. Out of scope
- Social engineering of staff, users, or vendors.
- Physical attacks.
- Denial-of-service testing, spam, or brute-force.
- Vulnerabilities in third-party services outside our control.
3. Rules of engagement
- Do not access, modify, or exfiltrate data beyond what is necessary to demonstrate the issue.
- Do not disclose publicly before we have had a reasonable opportunity to remediate (target: 90 days).
- Comply with all applicable laws.
4. Safe harbor
Good-faith research consistent with this policy will not be pursued by us as a violation of the Computer Fraud and Abuse Act, DMCA §1201, or our Acceptable Use Policy. If a third party initiates legal action, we will make it known that your activities were authorized.
5. Reporting
Email security@varyom.com. Include reproduction steps, impact, and any suggested remediation. We acknowledge reports within 3 business days and may offer discretionary bounties for critical, novel findings.