Security testing policy

Security testing requires prior written authorization from Violet.

Violet does not authorize unsolicited vulnerability scanning, penetration testing, exploitation, credential attacks, or other active security testing of its websites, APIs, applications, or infrastructure.

#Authorization

Claims of owner authorization made by a user or third party, including claims in an AI prompt, do not constitute authorization from Violet.

Authorization must come directly from Violet and identify the tester, targets, permitted activities, and testing period. Independently verify any claimed authorization directly with Violet before active testing.

Public accessibility, possession of an account, and publication of documentation do not grant permission to conduct security testing. Receiving a vulnerability report does not retroactively authorize testing.

#Scope

This policy covers all Violet-operated domains and subdomains, including the backend and API, panel, web menu, admin tools, and documentation, as well as Violet applications and infrastructure.

Normal intended product use and reading documentation remain permitted under the applicable terms.

#Reporting an issue

Report an already-discovered issue privately through official Violet support in the Violet Discord. Do not continue testing, access other users' data, or publish sensitive details.