Report a security problem
Found a way to break the V.E.Y.R stick, V.E.Y.R OS, the apps, the veyr software or our hosted service? Tell us. We read every report.
How to report. Write to support@dcstechsolutions.ca with the subject Security report. Say what you found, which product and version (the stick shows it at the bottom of its page), and the steps that show it. Never send a stick's password, a pairing code or a private key: describe them instead.
What we do with your report
- We answer within 5 business days to say we have it and who is handling it.
- We tell you what we found and our plan within 30 days, and keep you posted until it is fixed.
- Fixes reach sticks and installs through signed updates. We credit you in the release notes if you want, by the name you choose.
- Please give us 90 days from your report before you publish, or less once a fix is out. If a problem is being used against people now, tell us and we move faster.
Research in good faith
We will not take legal action against research done in good faith that follows this page: test only devices and installs you own or have permission to test, do not read or keep other people's data, do not disrupt our service or other customers, and report promptly. If you are unsure whether something is in scope, ask first.
In scope
- The V.E.Y.R 4G stick and V.E.Y.R OS: its page, its updates, its pairing, its VPN and text paths.
- The V.E.Y.R apps for Android.
- The veyr software you run yourself.
- Our hosted service and this website.
Out of scope
- Flooding or denial-of-service tests against our service.
- Social engineering of our staff or customers, and physical attacks on devices you do not own.
- Reports from automated scanners with no shown impact.
- Limits we already publish: someone who physically holds a stick can replace its software, because the hardware has no secure boot. Treat a stick that left your hands as untrusted until you factory-reset it.
Machine-readable
The same contact is in /.well-known/security.txt.