Cybersecurity & vulnerability reporting

Use the security options available from your sign-in provider, protect recovery channels and keep your device updated. Never send Vexido support your password, authentication code, recovery code or private access token.

Report suspected unauthorised access, exposure of private records or answer keys, malicious links, account impersonation or a vulnerability in the platform. Include the URL, approximate time, expected and observed behaviour and a minimal redacted illustration.

This reporting route is not permission to conduct penetration testing. Do not bypass authentication, access another person’s data, alter or delete records, perform denial-of-service testing, use stolen credentials or publish a working exploit. Obtain written authorisation and an agreed scope before active testing.

If you encounter information accidentally, stop exploring, do not retain unnecessary copies and report enough to allow investigation. No bounty or legal safe-harbour promise is created by this page.

Vexido assesses reports, works to limit further exposure and coordinates with relevant service providers and authorities where applicable. Incident handling includes assessing applicable reporting and record-retention obligations.

Affected users should receive appropriate information where required. Do not infer that a vulnerability is fixed merely because an acknowledgement was sent.