generated: '2026-10-07'
method: searched
probe: true
source: https://www.vaquill.ai/security/vulnerability-disclosure
url: https://www.vaquill.ai/security/vulnerability-disclosure
name: Vaquill AI Vulnerability Disclosure Programme
contact: contact@vaquill.ai
pgp: request our PGP key in your first message
bug_bounty: false
safe_harbor: true
safe_harbor_text: Vaquill AI considers security research conducted under this programme to be authorized activity.
scope:
- vaquill.ai and all subdomains (*.vaquill.ai)
- Vaquill AI web application (app.vaquill.ai)
- Vaquill AI REST API (api.vaquill.ai)
- Vaquill AI Slack app
- Vaquill AI MCP servers (mcp.vaquill.ai)
out_of_scope:
- Denial-of-service / traffic flooding
- Social engineering of staff, customers or sub-processors
- Physical attacks
- Automated-scanner findings without a working proof of concept
- Missing security headers
sla:
  acknowledgment: within 72 hours
  triage: within 5 business days
  remediation: Critical issues are patched within 7 days. High severity within 30 days. Medium and low severity within 90 days.
  disclosure: 90-day coordinated-disclosure timeline; credit by name in the security advisory if you wish
security_txt:
  url: https://www.vaquill.ai/.well-known/security.txt
  status: 404
  note: No RFC 9116 security.txt is served (probed 2026-10-07); the programme lives on the HTML page only.
evidence:
- source: https://www.vaquill.ai/security/vulnerability-disclosure
  kind: disclosure programme page
  keywords:
  - coordinated disclosure
  - safe harbor
  - CVSS v3.1
  - response SLAs
  - in scope
- source: https://www.vaquill.ai/security
  kind: disclosure page
  keywords:
  - vulnerability
  - responsible disclosure
  - security issue