Security
Found a security issue? Tell us.
If you’ve found a security issue affecting VERICORE S or one of our products, we’d rather hear about it directly so we can investigate it responsibly.
This page explains what you can test, what you shouldn’t test, and how to report what you find.
Last updated:2 October 2026
On this page
1.What’s in scope
- The official VERICORE S website and domains we operate
- VisaClear systems operated by VERICORE S
- Farola systems operated by VERICORE S
- SupplierHub systems operated by VERICORE S when publicly available for testing
- Other VERICORE S systems that are publicly accessible and clearly operated by us
Only test systems that are actually operated by VERICORE S. A link from one of our products to a third-party service does not put that service in scope.
2.What’s out of scope
- Denial-of-service, load or stress testing
- Social engineering, phishing or impersonation
- Testing that could disrupt our services or other users
- Accessing, downloading, changing or deleting another person’s data
- Third-party services and infrastructure we don’t control
- Automated scanner reports without manual verification
- Reports about best-practice configuration differences with no demonstrated security impact
3.Ground rules
If you’re testing one of our live systems, use only accounts and data you control.
If you discover that you can access information belonging to someone else, stop once you have enough evidence to demonstrate the issue. Don’t continue exploring or collect additional data.
Don’t intentionally disrupt a service, degrade its availability, or interfere with another user.
Please give us reasonable time to investigate and address a genuine vulnerability before publishing details about it.
4.Our commitment to you
If you conduct security research in good faith, stay within the scope of this policy and follow these guidelines, VERICORE S will not initiate legal action against you solely for that research.
This commitment does not apply to activity that is unlawful, intentionally harmful, disruptive, or outside the scope of this policy.
We appreciate responsible reports that help us protect our products and the people who use them.
5.How to report a security issue
When reporting an issue, include where possible:
- The affected VERICORE S product, page or endpoint
- Clear steps to reproduce the issue
- The security impact you believe it has
- Relevant screenshots, recordings or request/response details
- Any sensitive information appropriately redacted
Please don’t include personal information belonging to other people unless it is strictly necessary to explain the vulnerability.
6.What to expect
We’ll review reports and investigate issues we can reproduce.
VERICORE S does not currently operate a paid bug bounty programme. Reporting a vulnerability does not create an entitlement to payment or compensation.
7.Security contact
Our security contact is also published at /.well-known/security.txt.