Trust

Report a vulnerability

If you find a security issue in Vox, tell us privately so we can fix it before it is publicly discussed.

How to report

Email security@vox.uk with enough detail to reproduce the issue. Include the affected URL or component, steps, impact, and any proof of concept that does not harm customer data.

What to expect

We aim to acknowledge reports within three working days and to keep you updated while we investigate. Please give us a reasonable window to fix confirmed issues before any public disclosure.

Scope

In scope: the Vox web application, reporting pages, handler portal authentication and encryption flows, and infrastructure we operate for the product.

Out of scope: social engineering of customers, physical attacks, denial of service against production, and scanning that degrades service for reporters or handlers.

Safe harbour

If you make a good-faith effort to avoid privacy violations, data destruction, and service disruption, we will not pursue legal action for that research.

Product security overview: Encrypted before it leaves the screen.