Legal
Security
If you find a security problem in a Vesk Lab site or service, write to security@vesklab.com. We read every report, reply within five business days, and will not take legal action against good-faith research that follows this page.
Effective 9 November 2026
What you may test
- vesklab.com and www.vesklab.com
- hack.vesklab.com
- Vesk Lab’s public code repositories on GitHub, under the account IgorLima-py
What is out of scope
- The providers we run on, such as Cloudflare, Google, Stripe, Modal, Resend, Meta and TikTok. Report problems in their services to them.
- Denial of service, load testing, or anything that degrades the service for others.
- Social engineering, phishing, or contacting our users, partners or providers.
- Physical access, and anything outside the domains and repositories listed above.
How to test
- Use only accounts and data you created for the test, and delete them when you are done.
- If you reach someone else’s data, stop, do not keep or share it, and tell us right away.
- Send one request at a time, at a human pace; no automated scanning in volume.
What to send
The affected address, the steps to reproduce, and what an attacker could do with it. Please do not include secrets you found; describe where they are instead. Give us 90 days to fix the problem before you publish it, and we will agree on a date with you.
Proof of ownership
This site, its repositories and its commits belong to Igor Lima. The DNS record
_vesk-dono.vesklab.com holds a public token that is also written in the project’s private repository, and commits
are signed with keys published on the IgorLima-py GitHub account.