# Vulnerability Disclosure Policy

> **Draft for counsel review — not yet in force.** This document may change
> before it takes effect.



Dated 17 October 2026 · Version 2026-10-17

Ochre Editions is a service operated by Valor Security
({{VALOR_REGISTERED_NAME}}). If you find a security weakness in Ochre Editions,
we want to hear about it. This policy says what you may test, how to test it
safely, and how to tell us. Our `/.well-known/security.txt` points here.

## Scope

In scope:

- the Ochre Editions website, including its image host;
- the REST API described in `/openapi.json`;
- the MCP server at `/mcp`, and the sign-in and authorisation service agents
  use with it.

Out of scope:

- services run by others that we use, such as Stripe's checkout pages, our
  print partner, our email provider, Google Cloud's own infrastructure, and the
  museums' websites. Please report issues in those to their owners;
- denial-of-service and load testing;
- social engineering, phishing and physical attacks;
- reports from automated scanners with no demonstrated impact.

## Safe harbour

If you act in good faith and follow this policy, we consider your research
authorised. We won't take legal action against you or report you to law
enforcement for it, including under anti-hacking or anti-circumvention laws or
our [Terms of Use](/legal/terms). If someone else takes legal action over
research you did within this policy, we will make it known that your research
was authorised.

Good faith means you try to avoid harming people and data, you stop when you
have enough to show the issue, and you give us a fair chance to fix it before
anyone else hears about it.

_Counsel to confirm the safe-harbour wording before this policy takes effect._

## How to test safely

- Use accounts you created yourself. Access only your own data.
- If you reach someone else's data, stop, take no more than you need to show
  the issue, don't keep it, and tell us.
- **Don't exfiltrate data** beyond the minimum proof.
- **Don't degrade the service.** No denial of service, no flooding, and keep
  automated testing within our published rate limits.
- **Don't use social engineering** on our staff, customers or partners.
- Don't place real orders you won't pay for, use a payment card you aren't
  authorised to use, or interfere with another person's order or drop edition.
- Don't change or delete data that isn't yours.
- If you find a credential, key or hidden admin page, don't use it beyond
  confirming it is there. Report it.

## How to report

Email {{SECURITY_EMAIL}} with:

- what you found and where (the address or tool);
- the steps to reproduce it;
- the impact you think it has;
- how to reach you, and whether you'd like to be credited.

Please don't put details of an unfixed issue in public places.

## What happens next

- We acknowledge your report within 3 business days.
- We give you an initial assessment within 10 business days.
- We keep you updated while we fix it, and tell you when it is fixed.
- We ask that you give us 90 days from your report before you disclose it
  publicly, or less if we fix it sooner. We will agree a date with you.
- With your permission, we credit you when we disclose the issue.

This policy offers no payment for reports.

## Contact

{{SECURITY_EMAIL}}