Vulnerability Disclosure Policy

Reporting a vulnerability

Email security@virtualdojo.com with enough detail to reproduce the issue: the affected endpoint or component, the steps taken, and the impact you observed. If you need to send sensitive material, request our PGP key in your first message and we will provide it.

Please do not include live production data, customer records, or personally identifiable information in your report. A proof of concept against your own test account or a non-destructive demonstration is sufficient.

Scope

In scope: trust.virtualdojo.com, app.virtualdojo.com, and the documented certification-data API. Out of scope: findings that require physical access, social engineering of staff, denial-of-service testing, and reports generated solely by automated scanners without a demonstrated impact.

Our commitment

We acknowledge reports within three business days and will keep you informed as we investigate and remediate. We ask that you give us a reasonable period to remediate before any public disclosure, and that you avoid privacy violations, service disruption, and data destruction while testing.

We do not pursue legal action against researchers who act in good faith, stay within this policy, and give us the opportunity to resolve an issue before disclosing it.

Safe harbor

Activity conducted in accordance with this policy is considered authorized. If legal action is initiated by a third party against you for work done under this policy, we will take steps to make it known that your actions were conducted in compliance with it.