Vulnerability Disclosure Policy

Last Updated: June 11, 2026

At Vornado, we take the security of our Connected App and related services seriously. We welcome responsible disclosure of security vulnerabilities and appreciate the efforts of security researchers who help us improve our security.

Reporting a Vulnerability

If you believe you have identified a security vulnerability, please complete the form above and provide the following information:

• A description of the issue
• Steps to reproduce the vulnerability
• Affected feature, component, or service
• Any supporting evidence, such as screenshots or proof-of-concept details
• Contact information for follow-up questions

Once submitted, your report will be automatically forwarded to our Development Lead for review. The Development Lead will monitor for Vulnerability Reports on a daily basis.
When a new Vulnerability Report is submitted, the Development Lead will assess the report and assign it to an appropriate member of the Development Team for investigation and remediation. 

Response and Remediation Timeframes

• Critical and High Priority vulnerabilities will be addressed immediately.
• Medium Priority vulnerabilities will have remediation work initiated within 3–5 business days.
• Low Priority vulnerabilities will be addressed as resources permit and as soon as reasonably possible.

Communication

If contact information is provided, the Development Lead will acknowledge receipt of the report within 15 days and provide confirmation that the issue is under review.
The reporter (you) will also be notified once the vulnerability has been resolved.

Scope

This policy applies to the Vornado Connect App. Third-party systems and services not controlled by Vornado are outside the scope of this policy.

Vulnerability Severity

We generally prioritize vulnerabilities based on their potential impact, including:

Critical

• Remote code execution
• Unauthorized administrative access
• Complete compromise of user accounts or systems

High

• Authentication bypass
• Privilege escalation
• Significant exposure of sensitive information

Medium

• Access control weaknesses
• Limited data exposure
• Security misconfigurations with moderate impact

Low

• Information disclosure with minimal risk
• Security best-practice issues
• Low-impact vulnerabilities requiring unusual conditions

Research Guidelines

When testing and reporting vulnerabilities, please:

• Act in good faith.
• Avoid accessing, modifying, or deleting data that does not belong to you.
• Do not disrupt service availability or perform denial-of-service testing.
• Limit testing to what is necessary to demonstrate the vulnerability.
• Do not publicly disclose the issue until we have had a reasonable opportunity to investigate and address it.

Safe Harbor

We will not pursue legal action against individuals who engage in good-faith security research and comply with this policy. Activities conducted in accordance with this policy are considered authorized.

Our Commitment

We will:

• Acknowledge receipt of vulnerability reports within a reasonable timeframe.
• Investigate and validate reported issues.
• Prioritize remediation based on risk and impact.
• Communicate with reporters regarding the status of validated vulnerabilities, where appropriate.

Exclusions

The following generally do not qualify as security vulnerabilities unless a clear security impact is demonstrated:

• Missing security headers
• Version disclosure
• Reports based solely on automated scan results
• Low-risk configuration observations without exploitability

Thank you for helping us keep our users, devices, and services secure!