Section 01
Security Posture
Public statements about how Veast is built — without providing a roadmap to attackers.
- Server-signed push notifications; verified coach badges use Ed25519 signatures.
- Row-level security on every database table; no service-role key ships in the client app.
- Internal OWASP MASVS audit completed May 2026. A third-party penetration test is planned after launch.
- Encrypted secrets stored in Supabase Vault; rotation runbook documented and tested.
- Certificate pinning: the app's pin table holds an SPKI SHA-256 pin for veast.life. The Supabase API is deliberately not pinned; its connections rely on platform TLS (App Transport Security on iOS), signed JWT sessions and row-level security.
- Contact the security team: security@veast.life
Security Contact
security@veast.lifeFor vulnerability reports, security questions, and incident notification.
Section 02
Responsible Disclosure
We believe security researchers make the ecosystem safer. If you find a vulnerability in Veast, here is how we work with you.
Submit a Report
security@veast.lifeSend a description of the issue, the steps to reproduce it and the impact you observed.
Scope
In Scope
- →iOS app bundle —
life.veast.app (App Store) - →Android app bundle —
life.veast.app (Play Store) - →Supabase edge functions —
Veast's Supabase API, /functions/v1/* - →veast.life web properties —
veast.life and all subdomains
Out of Scope
- —Physical access attacks against the founder or Veast infrastructure.
- —Social engineering of Veast users or coaches.
- —Third-party services: Stripe, Apple, Google — report those directly to the respective provider.
- —Denial-of-service attacks against Supabase.
- —Spam, phishing campaigns, or brute-force login attempts.
- —Issues in software not maintained by Veast (OS, device firmware, ISP).
Bug Bounty Rewards
Reward amounts are in US dollars.
| Severity | Examples | Reward |
|---|---|---|
| Low | UI bugs that could mislead a user but no data or funds at risk. | $50 – $200 USD |
| Medium | RLS or access bugs limited to single-user data exposure. | $200 – $1,000 USD |
| High | Mass data exposure, authentication bypass, edge function privilege escalation. | $1,000 – $5,000 USD |
| Critical | Founding Member cap bypass, full RLS bypass. | $5,000 – $25,000 USD |
Note: Rewards are at Veast's discretion based on impact and report quality. Duplicate reports receive credit but no additional reward. Bounties are not paid for issues already known internally.
Disclosure Timeline
48h
Acknowledgement
We confirm receipt of your report within 48 hours.
7d
Status update
We provide an initial assessment and severity classification.
48h
Critical patch SLA
Critical vulnerabilities receive an expedited patch within 48 hours of confirmation.
90d
Standard disclosure
Standard 90-day window before public disclosure. We coordinate timing with the researcher.
Rules of Engagement
- →Do not access, modify, or destroy user data beyond what is necessary to demonstrate the vulnerability.
- →Do not perform actions that degrade or deny service to other users.
- →Do not perform automated scanning without prior written approval from security@veast.life.
- →Do not disclose the vulnerability publicly until the 90-day window has elapsed or we have issued a fix.
- →Act in good faith. Researchers who comply with these rules will not face legal action from Veast.
- →Testing against production environments is permitted only for non-destructive, read-only verification. For destructive testing, request a staging environment.
Hall of Fame
Researchers who responsibly disclosed valid vulnerabilities are recognized here.
No entries yet
Be the first researcher credited. Submit a valid report to security@veast.life.