Reporting vulnerabilities to us
We are grateful for good-faith security research and want it to be easy to route to the right place.
This page explains what is in scope, how to report, what you can expect from us in return, and how reporting us relates to reporting the platforms we monitor. The short version: write to info@getveristria.com, expect a reply within two business days, and tell us if you want credit.
How to report, and what happens next
Send reports to info@getveristria.com, which is the monitored channel for all security mail. Include a description of the issue, the steps or scripts needed to reproduce it, the affected surface — web application, API, CLI or probe network — and, where relevant, identifiers such as scan or request identifiers that help us locate the trail. Please avoid automated scanning against accounts you do not own and any action that degrades the service for others.
We acknowledge every report within two business days, and most within one. From there we confirm the issue, keep you informed as fixes land and agree a coordinated publication date — ninety days is the default window, extended by mutual agreement if a fix needs longer. We will not pursue legal action against good-faith research that respects these bounds.
Thanks, and scope
Researchers who wish to be credited are named, with their preferred handle and a link, in the thanks section of this page once a fix ships; anonymity is equally respected, so ask for nothing and nothing is published. In scope are the RowShield web application and API, the CLI and the probe infrastructure we operate. Out of scope are volumetric disruption, spam, social engineering of staff and issues requiring an account you are not authorised to hold.
One independence point, stated plainly because it matters: RowShield monitors Supabase projects but is not Supabase and is not affiliated with Supabase. Vulnerabilities in the Supabase platform itself belong to Supabase's own security team, whose work we do not speak for. If your finding touches their platform, we will pass it along with your permission and stay copied so you are not left chasing two queues alone.
Did this answer your question? If not, tell us what is missing — article corrections go straight to the person who maintains it.