Reporting a vulnerability
If you believe you have found a security vulnerability in Villva, email security@villva.com. Please include what you found, the steps to reproduce it, the impact you expect it to have, and whether you would like to be credited.
Write in English, and encrypt the report if it contains anything sensitive by asking us for a key first. Please do not report security issues through the public contact form or support channels.
What happens next
- Acknowledgement within 3 business days of your report.
- Triage within 10 business days: whether we can reproduce it, the severity we assign, and what happens next.
- Fix targets from triage: critical within 30 days, high within 60 days, medium and low within 90 days.
- We keep you updated at each step and tell you when the fix is live. If a fix will take longer than its target we tell you why, and when to expect it.
Scope
In scope:
- The Villva application at *.villva.com, including every customer workspace subdomain and its API.
- This website, villva.com.
Out of scope
- Denial-of-service, load or volumetric testing.
- Social engineering, phishing or physical attacks against Villva staff or customers.
- Third-party services we use, which have their own disclosure programmes.
- Findings that need a rooted device, an outdated browser, or physical access to a victim's machine.
- Missing best-practice headers or banners with no demonstrated impact.
Testing rules
- Use only accounts you created or have written permission to use.
- Never access, change or delete data that is not yours. If you reach another customer's data, stop, and report what you saw without keeping it.
- Give us reasonable time to fix an issue before disclosing it publicly. We will agree a disclosure date with you.
Safe harbour
If you research and report in good faith and within these rules, we will not pursue legal action against you, and we will not ask anyone else to. We consider such research authorised, and we will say so if a third party raises it. If you are unsure whether something you plan to do is within these rules, ask us first at security@villva.com.
Personal data in reports
A report can contain personal data — yours, or data you came across. We handle it to the same standard as anything else the product holds: access is limited to the people handling the report, it is used only to fix the issue and contact you, and it is deleted once the issue is closed, unless you ask us to keep your details for credit.
Recognition
We do not run a paid bounty programme yet. With your permission, we credit researchers who report valid issues on this page once the fix is live.