VeriCortex

Security Notice & Responsible Disclosure Policy

Security Notice & Responsible Disclosure Policy

Effective Date: May 14, 2025

At VeriCortex, the security of our systems, users, and data is a top priority, particularly for the OmoSafe mobile app, designed to protect children in digital environments. This Security Notice and Responsible Disclosure Policy governs the responsible reporting of security vulnerabilities in VeriCortex platforms, ensuring the integrity, confidentiality, and availability of our products and services. We comply with the Nigeria Data Protection Act (NDPA), GDPR, COPPA, and other applicable laws, prioritizing the security of children’s data. This policy aligns with our Privacy Policy and Terms and Conditions, available at www.vericortex.com/privacy-policy and www.vericortex.com/terms.

This policy applies to all users, security researchers, and stakeholders interacting with VeriCortex platforms, including:

  • OmoSafe mobile app
  • VeriCortex website (www.vericortex.com)
  • Compliance and cybersecurity tools
  • Public APIs, cloud-hosted services, and administrative dashboards

1. Our Commitment

We:

  • Take all security reports seriously.
  • Will not pursue legal action against individuals reporting vulnerabilities in good faith.
  • Strive to acknowledge, investigate, and resolve valid security issues promptly.
  • Attribute credit to responsible researchers (with consent).

1.1 Safe Harbor: We provide a safe harbor for good-faith researchers complying with this policy, ensuring no legal action under laws like Nigeria’s Cybercrimes Act or U.S. DMCA. This protection does not apply to malicious exploitation or actions causing harm to users, especially children.

2. How to Report a Vulnerability

2.1 Secure and Anonymous Reporting: Submit reports via encrypted email to security@vericortex.com. Anonymous reports are accepted but should include sufficient detail for validation. Avoid including sensitive child data unless necessary, and use secure methods (e.g., PGP encryption) for transmission. We maintain strict confidentiality for all reports. Include:

  • A clear, concise description of the issue.
  • Steps to reproduce (proof-of-concept if applicable).
  • Potential impact assessment.
  • Your contact details (optional for anonymous reports).

3. What to Expect

3.1 Response Timeline: We acknowledge reports within 3 business days, validate issues within 7 business days, and aim to resolve critical vulnerabilities within 30–90 days, depending on severity. Child safety-related issues (e.g., geolocation, parental controls) are prioritized. We provide updates every 14 days until resolution, based on severity and impact on users, particularly children.

3.2 Public Disclosure: We coordinate public disclosure with researchers, targeting 90 days post-resolution. Critical child safety vulnerabilities may require earlier or delayed disclosure to protect users. Joint announcements are preferred when feasible.

4. Scope

4.1 Covered Platforms: This policy covers the OmoSafe mobile app (including child safety features like geolocation and alerts), the VeriCortex website (www.vericortex.com), public APIs, cloud-hosted tools, and administrative dashboards.

4.2 Third-Party Integrations: Vulnerabilities in third-party services (e.g., Google Maps, Firebase) integrated with OmoSafe are out-of-scope but may be reported to security@vericortex.com for coordination with providers. Out-of-scope items like social engineering or DoS attacks are excluded due to their distinct handling requirements.

4.3 Third-Party Coordination: For vulnerabilities in third-party services integrated with OmoSafe, report to security@vericortex.com. We coordinate with providers to address issues, prioritizing those impacting child data.

5. Guidelines for Responsible Research

To ensure good-faith research:

  • Do not exploit or abuse vulnerabilities beyond necessary testing.
  • Do not access, modify, or delete data that is not your own.
  • Avoid privacy violations, service interruptions, or data destruction.
  • Do not publicly disclose vulnerabilities until coordinated with our team.

5.1 Child Safety Guidelines: Do not test vulnerabilities in ways that risk child data or safety features (e.g., geolocation, alerts) without prior authorization. Use sandboxed or test environments to avoid disrupting live services. Researchers must comply with GDPR, COPPA, and NDPA. Non-compliant research may result in exclusion from recognition or legal action if malicious.

6. Recognition

6.1 Recognition Program: Eligible researchers submitting valid, non-duplicate vulnerabilities may receive public recognition on our Hall of Thanks, private acknowledgment, or, for critical issues, a bug bounty (amounts based on severity, starting at $50). Researchers may opt out of public recognition for privacy. Contact security@vericortex.com for eligibility details.

7. Child Safety Vulnerabilities

Vulnerabilities impacting OmoSafe’s child safety features (e.g., geolocation, alerts, parental controls) are prioritized for immediate escalation and resolution. We limit internal access to such reports and coordinate closely with researchers to ensure child safety during disclosure.

8. Accessibility and Support

Our policy and reporting interfaces comply with WCAG 2.1 standards. For security reports or support, contact our Security Team via:

  • Email: security@vericortex.com
  • Secure Web Form: www.vericortex.com/security-report
  • Phone: +234-901-529-2170
    We will respond to non-security inquiries as soon as possible

9. Dispute Resolution

Disputes regarding this policy will be resolved through mediation in Lagos, Nigeria, before escalation to arbitration or litigation. Safe harbor protections remain for good-faith researchers.

10. Policy Updates

We may update this policy, notifying researchers via our website or email at least 14 days before changes take effect. Previous versions are available at www.vericortex.com/policy-archive.

11. International Compliance

We comply with international security and data protection laws, such as GDPR and U.S. DMCA exemptions. Researchers must adhere to their local laws when reporting. Vulnerability reports involving personal data are handled with safeguards like standard contractual clauses.

Thank you for helping VeriCortex build secure, trustworthy technology. Your vigilance and cooperation help protect users, especially children, partners, and digital communities worldwide.