velsa
Reporting a security vulnerability.
Palladium Innovations, LLC welcomes good-faith reports of security vulnerabilities in Velsa and its public web properties. This page explains how to report, what to expect, and the safe-harbor terms for your research.
Last updated: 17 July 2026
/.well-known/security.txtScope
This policy covers the Velsa application and the public sites operated by Palladium Innovations — velsa.io and its subdomains, including demo.velsa.io. Third-party services we rely on are out of scope; please report issues in those to their respective operators.
How to report
Email security@velsa.io. To help us triage quickly, please include:
- What you found, and where (URL, endpoint, or component).
- Steps to reproduce, and any relevant request/response details.
- The impact you believe the issue has.
Please do not include customer data in your report. If a proof of concept requires sensitive data, describe it rather than attaching it.
What to expect
We acknowledge reports within 3 business days and will keep you informed as we triage and remediate. We ask that you give us a reasonable opportunity to remediate before any public disclosure, and we're happy to coordinate timing with you.
Safe harbor
We will not pursue legal action for good-faith, in-scope security research that respects the following rules:
- Do not access, modify, or exfiltrate data that is not yours.
- Do not degrade or disrupt the service.
- Do not use social engineering, phishing, or physical attacks.
- Stop and report as soon as you can demonstrate the issue.
If you make a good-faith effort to comply with this policy during your research, we will consider it authorized, and we will work with you to understand and resolve the issue quickly.
Out of scope
The following are not in scope for this program:
- Denial of service, volumetric, or spam testing.
- Social engineering of Palladium personnel or customers.
- Physical attacks against facilities or hardware.
- Findings on third-party services we use rather than operate.
Rewards
We do not operate a paid bug-bounty program at this time. We're grateful for responsible disclosure and will gladly credit researchers who wish to be acknowledged.