Responsible disclosure

Security researchers play an important role in keeping our clients and their borrowers safe. If you have found a security vulnerability in any Vaman service, we want to hear about it.

How to report

Email your findings to security@vaman.tech.

Please include:

• A clear description of the vulnerability
• The URL or component affected
• Steps to reproduce the issue
• Any supporting evidence (screenshots, request/response logs)

What happens next

• We will acknowledge your report within two working days.
• We will keep you informed of our progress.
• We ask that you do not publicly disclose the issue until we have had reasonable time to address it.
• We will not take legal action against researchers who act in good faith under this policy.

Scope

This policy covers vaman.tech and any subdomains operated by Vaman. It does not cover third-party services or infrastructure not under our control.

Out of scope

• Denial-of-service attacks
• Social engineering of Vaman staff or clients
• Vulnerabilities in third-party services we use
• Reports generated entirely by automated scanners

Thank you

We appreciate the work of security researchers in making our services safer. We recognise responsible disclosures and will thank researchers publicly with their permission.