Security
Verity takes security seriously. If you discover a vulnerability in our products or infrastructure, we want to hear about it.
Reporting a vulnerability
Email [email protected] with a description of the issue, steps to reproduce, and any supporting evidence. Please do not disclose the vulnerability publicly until we have had an opportunity to address it.
What to expect
- Acknowledgement — within 48 hours of your report.
- Triage — within 5 business days we will assess severity and provide an initial response.
- Resolution — we aim to resolve confirmed vulnerabilities promptly and will keep you informed of progress.
- Credit — with your permission, we will credit you publicly for the discovery.
Scope
This policy covers:
- verityapp.io — the marketing website and web application
- Verity for macOS, Windows, and Linux — the desktop application
- Verity for iOS — the mobile application
- Backend API services — authentication, transcription, and account management
Out of scope: third-party services we use (report directly to the provider), social engineering, denial-of-service attacks, and issues that require physical access to a user's device.
Safe harbor
We will not pursue legal action against security researchers who discover and report vulnerabilities in good faith, follow this policy, and do not access, modify, or delete other users' data. Research conducted under this policy is considered authorized under applicable anti-hacking laws.