VAPTCoordinated vulnerability disclosure platformResearcher recognition, vendor coordination, and CVE support
LoginRequest CVE
Operational governance

Complaints policy.

This policy defines how complaints about VAPT workflows are submitted, reviewed, escalated, and resolved.

1. Purpose

VAPT maintains a structured complaints process to ensure concerns are handled consistently, transparently, and with appropriate oversight.

This policy applies to complaints related to VAPT operations, disclosure handling, support responses, and associated public content.

2. Complaint categories

  • Service quality concerns related to triage, communication, or disclosure workflow handling.
  • Concerns about administrative processing, account actions, or policy enforcement decisions.
  • Concerns about published advisory content, correction handling, or timeline conduct.
  • Professional conduct concerns involving platform interactions with researchers, vendors, or operators.

3. How to submit a complaint

Complaints can be submitted through the Support desk by opening a ticket under the "Complaint" category, or by email to [email protected]. Include the following details for efficient processing:

  • Your full name and preferred contact details.
  • A clear description of the complaint, including dates, request codes, report IDs, or ticket references where available.
  • Any supporting evidence that helps us assess the issue accurately.
  • The outcome you are requesting.

4. Handling timeline

  • Acknowledgement within 2 business days.
  • Initial assessment and assignment within 5 business days.
  • Substantive update or resolution target within 15 business days, subject to complexity.
  • Escalation path to senior operations and legal/compliance representatives where needed.

If additional time is required due to technical complexity, legal review, or multi-party coordination, we will communicate revised timelines with justification.

5. Records and confidentiality

Complaint records are retained in line with operational, legal, and audit requirements. Access is limited to authorized personnel with a need to know.

Where complaints intersect with active vulnerability disclosures, confidentiality safeguards remain in effect and may limit what can be shared during review.