If you've found a security problem on our site — something that shouldn't be exposed, a way around a checkout safeguard, anything that genuinely worried you while you were browsing — we'd rather hear about it from you than find out the hard way later. This page explains how to report it, what we ask in return, and what happens after you do.

What counts as something worth reporting

We're talking about real security issues here: a way to access data that shouldn't be visible, a vulnerability in how checkout handles payment or account information, an authentication bypass, exposed admin functionality, that kind of thing. Not sure if something qualifies? Send it anyway — we'd rather look at something minor than miss something that isn't.

This isn't the place for general bug reports (a broken image, a typo, a slow-loading page) — those are welcome too, but they can go to our regular support email instead. This page is specifically for issues with real security implications.

How to report it

Email info@viloralab.store — this is the only channel we ask you to use. Please don't reach out to individual staff members directly or post about it publicly before we've had a chance to look into it; keeping it to one channel means nothing gets lost or handled inconsistently. Include:

• A clear description of what you found, in plain language
• Steps to reproduce it, if you're able to walk through them
• Screenshots or a proof of concept, if you have one
• A way to reach you, if you're open to follow-up questions

Our commitment to you (Safe Harbor)

If you follow the guidelines on this page while investigating and reporting an issue, we won't pursue legal action or report you to authorities as a result of that research. Specifically, we ask that you:

1. Give us a reasonable amount of time to review and fix the issue before sharing any details publicly or with anyone else
2. Don't access, modify, or interact with another person's account or data without their consent
3. Make a genuine effort to avoid privacy violations, service disruptions, or data loss while investigating
4. Don't exploit the issue beyond what's needed to demonstrate it exists — that means no further digging for additional access, no attempting to pull real customer data, nothing beyond proving the vulnerability is real
5. Stay within the law otherwise — this isn't a pass to do anything you couldn't otherwise justify

If you accidentally trigger something during testing — access data you shouldn't have, disrupt a service, that kind of thing — just tell us in your report. Being upfront about it is covered by this same commitment; trying to hide it afterward isn't.

What happens after you report something

We'll acknowledge your report within [2 to 5 business days] and keep you updated as we work through it — whether we could reproduce it, what we're doing, and roughly when it'll be resolved. Issues that touch payment or customer data get prioritized and handled carefully, which sometimes means slower rather than faster, because we'd rather get it right.

Why this matters to us

We're a small store, not a company with a dedicated security team watching things around the clock. Reports like this genuinely help, more than a template page like this one might suggest, and we don't take that for granted.