Security & responsible disclosure
We take the security of Verlocx and this website seriously. If you believe you've found a vulnerability, we want to hear about it.
How to report
E-mail [email protected] with a description of the issue, the affected URL or component, steps to reproduce it and, if possible, a proof of concept. You can also find this contact in /.well-known/security.txt.
Please
- give us reasonable time to fix the issue before disclosing it publicly;
- only access, modify or delete data that is your own — stop as soon as you have shown the issue;
- avoid privacy violations, service degradation and destruction of data;
- do not use social engineering, physical attacks or denial-of-service tests.
What we do
- acknowledge your report within a few working days;
- keep you informed while we investigate and fix it;
- not take legal action against research carried out in good faith within these guidelines.
How Verlocx is built
- Team and Enterprise run entirely on the customer's own infrastructure; the Free plan runs in our cloud.
- Guests run an outbound-only agent that trusts a single, pinned backend key.
- Agent updates are signed and verified (SHA-256) before installation.
- Secrets such as domain-join credentials are stored encrypted and never sent to the browser.
- Every action in the portal is permission-checked and written to an audit log.