Security & Responsible Disclosure

If you find a vulnerability in Ovyero, please tell us before disclosing it publicly.

Report contact: security@visnryentertainment.com
Every report is read by a person. We aim to acknowledge reports promptly and will tell you what we decide. If this contact changes, this page will be updated.

Scope (in-scope)

ovyero.visnryentertainment.com and all subpaths
The published CLI tarball at /package.tgz
The hash-chain verifier and audit ledger format

This list is updated as our hosts change.

Out of scope

Findings against third-party infrastructure we don't control (Railway, Stripe, Resend), please report those to the respective vendors
Denial-of-service via volumetric flooding
Social engineering of our staff
Physical attacks against Railway data centers
Self-XSS that requires the victim to paste payloads into a console

What we ask

Give us a reasonable window (30 days default) to remediate before public disclosure
Don't access, modify, or destroy customer data, proof-of-concept against your own Ovyero account is fine
Don't run automated scans that degrade service for other customers
Tell us how to reproduce the issue and what impact you observed

Last updated: 2026-10-11.