DER Security Corp's Penetration Testing and Responsible Disclosure Policy (POL-VM-001).
security@dersec.io. We acknowledge reports within two business days and provide a substantive response within ten business days. Machine-readable contact information is published at /.well-known/security.txt per RFC 9116.