Verify Vulnerability Disclosure
Responsible disclosure rules for verify.attestlayer.com.
Policy version: 2026-09-25
This disclosure page covers verify.attestlayer.com only, including the browser verification UI, public verification slug pages, download mirrors served by Verify, and Verify-controlled static assets.
How to report
AttestLayer maintains a coordinated vulnerability disclosure channel. The disclosure process is a reporting channel, not a penetration test or bug bounty.
AttestLayer uses one vulnerability disclosure policy for all of its sites: attestlayer.com/vulnerability-disclosure. Report issues to security@attestlayer.com.
Rules of engagement
- Keep testing non-destructive and narrowly scoped to the Verify surface.
- Do not exfiltrate data, degrade availability, or test against customer systems.
- Stop once you have enough evidence to demonstrate the issue safely.
- Do not social-engineer AttestLayer personnel or third-party providers.
Out of scope
- Issues that affect only customer environments, third-party processors, or non-AttestLayer systems.
- Denial-of-service testing, spam, click-fraud, or physical security claims.
- Reports that require public disclosure before AttestLayer has had a reasonable remediation window.
This page does not promise a response time, remediation result, or reward. The VDP is a reporting channel, not a penetration test or bug bounty.
Verify is a public, read-only verification surface. It does not create a paid service relationship on its own.
