Draft for reference — this content must be reviewed by legal counsel before official publication.
Last updated: Draft — not yet in effect
1. Scope
- vdxai.net and subdomains managed by VDX AI.
- Public applications and APIs of the VDX AI platform.
- Out of scope: customer systems, third-party services, denial-of-service and social engineering.
2. Rules of engagement
- Do not access, modify or delete data that isn’t yours.
- Stop testing and report immediately if you reach sensitive data.
- Do not disclose a vulnerability before we fix it and agree.
- Comply with Vietnamese law throughout testing.
3. How to report
Email security@vdxai.net with a description, reproduction steps, impact and evidence (screenshots, video). We acknowledge within 3 business days.
4. Rewards
Rewards are based on severity and report quality. The first report of a new vulnerability takes priority.
5. Safe harbour
We will not pursue legal action against researchers who follow these terms and act in good faith.