Vulnerability Disclosure Policy

Last updated 23 October 2026

Who we are. Vitrio is a trading name of Vitrio Limited, a company registered in England and Wales under company number 17515286. We are based in Sheffield, United Kingdom. You can reach us at ebujoe007@gmail.com.

Laboratories trust Vitrio with their records, so we want to hear about security weaknesses and fix them quickly. If you find one, please tell us. This policy says how, and what we promise in return.

How to report

Email ebujoe007@gmail.com with "Security" in the subject. Tell us what you found, where, the steps to reproduce it and the impact you think it has. Screenshots and short proof-of-concept requests help. Our machine-readable contact details are at /.well-known/security.txt. Please do not post details publicly before we have fixed the problem.

What is in scope

• The Vitrio website and application on the vitrio domain, and its API.
• Weaknesses such as access to another laboratory's data, authentication or session problems, injection, cross-site scripting, request forgery, insecure file handling, exposed secrets and misconfiguration.

What is out of scope

• Denial of service, volumetric or automated scanning that degrades the service, and social engineering of our staff or customers.
• Physical attacks, and weaknesses in third-party services we use (report those to the provider).
• Findings with no security impact, such as missing headers on pages with no sensitive content, or software version banners.

Rules for good-faith testing

• Test only with accounts you own or have permission to use, and stop as soon as you have shown the problem exists.
• Do not access, change, copy or delete data that is not yours. If you reach someone else's data by accident, stop and tell us.
• Do not run tests that affect other users' ability to use the service.

If you follow these rules and report promptly, we will treat your research as authorised, will not take legal action against you for it and will not ask for you to be reported to any authority.

What you can expect from us

• An acknowledgement within 3 working days.
• A first assessment within 10 working days, and regular updates until it is resolved.
• Credit for your finding if you want it, once it is fixed. We do not run a paid bounty programme at present, but we are glad to thank you publicly.