> How to report a security vulnerability in Vaartix, what is in scope, and what you can expect from us.

Source: https://vaartix.com/security

# Security and vulnerability disclosure

Last updated: 6 November 2026

**In short:** if you find a security problem in Vaartix, email [security@vaartix.com](mailto:security@vaartix.com). Test only against your own account, don't touch other people's data, and give us time to fix it before you tell anyone else. We'll reply within three working days and keep you updated until it's fixed.

## 1\. How to report

Email [security@vaartix.com](mailto:security@vaartix.com). For the SDKs you can also report privately on GitHub, through **Security** → **Report a vulnerability** on [vaartix-node](https://github.com/vaartix-mail/vaartix-node), [vaartix-python](https://github.com/vaartix-mail/vaartix-python) or [vaartix-php](https://github.com/vaartix-mail/vaartix-php). Please include:

-   What the problem is and what an attacker could do with it
-   The steps to reproduce it: the URLs, requests or code involved
-   Your team or account ID if it involves your account, never someone else's data
-   How you'd like to be credited, if at all

Please don't report security problems through the support form or in public GitHub issues.

## 2\. What's in scope

-   vaartix.com, including the docs at vaartix.com/docs
-   The dashboard at app.vaartix.com
-   The API at api.vaartix.com
-   The SMTP relay at smtp.vaartix.com
-   The official SDKs: vaartix-node, vaartix-python and vaartix-php

## 3\. What's out of scope

-   Denial of service, load or volume testing, and anything that slows the service for others
-   Sending email to people who haven't agreed to receive it, or testing our abuse controls by spamming
-   Social engineering of our staff or customers, and physical attacks
-   Reports from automated scanners without a way to exploit them, such as a missing header on a page with nothing sensitive on it
-   Problems in services we use (Amazon Web Services, Cloudflare, Razorpay, Sentry). Report those to them

## 4\. Rules for testing

-   Use only accounts and domains you own. Don't access, change or delete anyone else's data.
-   If you come across other people's data, stop, don't keep a copy, and tell us.
-   Send test emails only to addresses you control, or to the [test addresses](https://vaartix.com/docs/sending/test-mode/) at test.vaartix.com.
-   Give us a reasonable time to fix the problem before you disclose it: we ask for 90 days, or less once a fix is out.

If you follow this policy in good faith, we will not pursue or support legal action against you for your research, and we will work with you to understand and fix the issue.

## 5\. What you can expect from us

-   A reply within three working days (India time) confirming we've received your report
-   Our assessment, and updates at least every two weeks until the problem is fixed
-   Credit on this page once it's fixed, if you'd like it

Vaartix is in private beta and doesn't run a paid bug bounty yet.

## 6\. security.txt

The same contact details are published in [/.well-known/security.txt](https://vaartix.com/.well-known/security.txt) ([RFC 9116](https://www.rfc-editor.org/rfc/rfc9116)), on vaartix.com, app.vaartix.com and api.vaartix.com.

## 7\. Contact

NAP Designs (Vaartix), Bangalore, Karnataka, India
Security: [security@vaartix.com](mailto:security@vaartix.com)