Vulnerability disclosure policy

We want to hear about security problems in Venom. This policy explains how to report one, what is in scope, what we ask of you, and what you can expect from us.

How to report

Email support@venomlabs.dev with “Security” in the subject line. Please include:

• what you found and where (the address, endpoint or MCP tool, and the component or version if you know it);
• the steps to reproduce it, with any proof-of-concept code, requests or screenshots;
• what you think an attacker could do with it; and
• how we can reach you, and whether you’d like to be credited.

Please write in English or Spanish. If you’d rather report through a third party, you can contact INCIBE-CERT, Spain’s national computer security incident response team, which will pass the report on to us; you can stay anonymous to us that way.

What’s in scope

• venomlabs.dev, app.venomlabs.dev, mcp.venomlabs.dev and docs.venomlabs.dev;
• the Venom MCP server and its OAuth endpoints, including registration, authorization, token and revocation;
• the Venom plugins and extensions we publish (github.com/venomlabs-dev/plugin).

What’s out of scope

• services run by others, even when Venom uses them: Amazon Web Services, Stripe, Google, Cloudflare, PostHog, Attio, Slack, GitHub, the AI clients you connect, and third-party MCP servers; please report problems in them to their owners;
• denial-of-service, load or volume testing, and anything that degrades the Service for others;
• social engineering or phishing of our staff or customers, and physical attacks;
• spam or abuse of invitation and mention emails;
• findings without a demonstrable security impact, such as missing security headers on pages without sensitive actions, version disclosure, or self-XSS;
• automated scanner output that you haven’t verified.

Rules for testing

• Use only accounts and organizations you created yourself for testing. Never access, change or delete data that belongs to someone else.
• If you come across another person’s data, credentials or secrets, stop, don’t keep or share them, and tell us straight away what you saw.
• Don’t run tests that could harm availability, and stay well under our rate limits.
• Don’t use what you find for anything other than showing the problem to us, and don’t demand payment in exchange for not disclosing it.
• Give us a reasonable time to fix the problem before you tell anyone else (see “Coordinated disclosure” below).

Our safe-harbour commitment

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not file a criminal complaint against you, bring a civil claim, or treat your research as a breach of our Terms of Service. If someone else brings a claim against you over research that followed this policy, we will make it known that your research was authorised by us.

We can only speak for Venom Labs, S.L. We can’t authorise testing of other companies’ systems, and we can’t bind public authorities: in Spain, prosecutors can act without a complaint from us when an offence affects many people or the general interest. Following the rules above, and especially never accessing other people’s data, keeps you on the right side of that line. If you’re unsure whether something is allowed, ask us first at support@venomlabs.dev.

What you can expect from us

• We acknowledge your report within 3 working days.
• We give you our initial assessment, including whether we can reproduce the problem and how severe we think it is, within 10 working days.
• We keep you updated at least every 30 days until the problem is fixed.
• We aim to fix confirmed vulnerabilities within these times from confirmation: critical, 14 days; high, 30 days; medium, 90 days; low, when we can. If we need longer, we tell you why.
• We tell you when the fix is live.

Coordinated disclosure

We ask you to keep the details private until we have fixed the problem, and in any case for 90 days from your report, unless we agree a different date with you. When a fix is live, we publish a short advisory describing the problem, who was affected, how severe it was and what users need to do (if anything), and we credit you if you want us to. If a vulnerability is being actively exploited, we may publish sooner, and we notify the authorities where the law requires it.

No bug bounty

We don’t pay rewards for reports at the moment. We’re grateful for every report and happy to credit you.

Your personal data

We use the details you send us only to handle your report, credit you if you want, and meet our legal obligations, on the basis of our legitimate interest in keeping Venom secure. See our Privacy Policy.

Thanks

We thank the following people for reporting security issues responsibly:

• (none yet)

For how we protect your data, see Security. Our security.txt is at venomlabs.dev/.well-known/security.txt.