One account
Sign-in runs through a managed identity provider, and every app talks to one API.
Find a flaw. Tell us first.
Report a security issue in good faith. We reply within 72 hours, work with you on a fix, and credit you when it ships.
Severity
$100 to $250Stored XSS, SSRF, privilege escalation, IDOR on sensitive data
Steps to reproduce- Open a share review link as an invited client
- Change the review id in the request
- Response returns another project’s comments
Timeline
- ReceivedMon 09:12
- AcknowledgedWithin 72 hours
- TriagedSeverity confirmed
- FixedPatch shipped
- CreditedUnless you opt out
How we protect your work. By default.
Security was part of the design from day one, not a patch after launch.
Billing stays on the server
Plans & entitlements are checked server-side, never the browser.
Cards never touch us
Payments go through Stripe checkout. We never see your card number.
Rooms check access
You can only join a file’s live room if you can read that file.
Cursors are never stored
Live cursor positions pass between people and are never written down.
Plugins are boxed in
Signed packages, explicit permissions, sandboxes, and limits on every call.
Share tokens are encrypted
Link tokens are stored encrypted and looked up by a keyed hash.
Limits and bot checks
Rate limits across the API, and bot protection on public forms.
Links you stay in charge of.
Share links can need a password, expire on a date, or be turned off at any time. Every open is logged.
- Password protection
- Expiry dates
- Revoke in one click
- An access log for every link
usevarial.com/share/••••••••LivePassword
Expires
Recent opens- Travis · clientToday, 10:42
- Marty · clientYesterday, 16:05
- YouSep 12, 09:18
Password on · 14 days
What to test. And what to skip.
Stay in scope and you are covered by safe harbor.
- *.usevarial.com production subdomains
- Authentication and sessions
- Authorization and access control
- Server-side injection (SQLi, SSRF, RCE)
- Stored and reflected XSS
- Cross-site request forgery
- Insecure direct object references
- Sensitive data exposed by the API
- Payment and billing logic
- Rate limiting and brute force, unless chained
- Self-XSS with no victim impact
- Missing headers with no working exploit
- Logout CSRF
- Social engineering, phishing, or physical attacks
- Denial of service
- Third-party dashboards (Firebase, Stripe)
- Unverified scanner output
How to report. Four steps.
Find
Find an in-scope issue and confirm it by hand. Scanner output alone does not count.
Write it up
The affected endpoint, steps to reproduce, the impact, and any evidence.
Send it
Email security@usevarial.com. We acknowledge within 72 hours.
Work with us
Give us time to fix it before you publish. We keep you posted and credit you.
Direct linesecurity@usevarial.com
Read by the founder. Acknowledged within 72 hours. PGP key on request.
Include the affected endpoint, steps to reproduce, the impact, and how to reach you. Proof-of-concept code is welcome. Never include real credentials.
Rewards.
We are an early, Solo founded (& solo funded) company. Payouts are planned & will grow as Varial does.
Remote code execution, auth bypass, account takeover, payment manipulation
Stored XSS, SSRF, privilege escalation, IDOR on sensitive data
Reflected XSS, CSRF with impact, information disclosure
Open redirect, verbose errors, minor misconfiguration
Rewards are paid at Varial’s discretion. Duplicates, out-of-scope reports, and unverified scanner output do not qualify.
Safe harbor.
If you act in good faith and follow this policy, you're appreciated. Unsure if something crosses a line? Ask first.
We will
- Not take legal action against good-faith research that follows this policy
- Treat your research as authorized under the CFAA, where it applies
- Work with you to understand and fix the issue quickly
- Credit you publicly, unless you would rather stay anonymous
- Avoid privacy violations, data destruction, and service disruption
- Never access, change, or delete other people’s data
- Give us reasonable time to fix before you disclose
Where the program is going.
- NowDirect email disclosuresecurity@usevarial.com, read by the founder.
- NextStructured bounty tiersPublished payout ranges and response targets.
- LaterA bounty platformA dedicated platform, ready for procurement.
- Long termAudits and complianceIndependent audits and reports like SOC 2.
Questions? Answers.
Do I need permission before testing?
No, as long as you stay in scope and follow the rules on this page. If you are unsure, email us first :) security@usevarial.com
Can I test with a real account?
Use your own accounts only. Never touch data that belongs to someone else. We are in the process of creating a sandbox for researchers
How long until I hear back?
We try to acknowledge every report within 72 hours, from a real human.
Can I publish my findings?
Yes, after the issue is fixed and we have agreed on timing.
Do you pay for duplicates?
No. The first valid report of an issue is the one that counts.