Security, rules of engagement & disclosure

Every Vantagea engagement is governed by written rules of engagement agreed before any reconnaissance or active testing begins. This page sets out how we bound testing, verify findings, handle client evidence, and process vulnerability disclosures.

Rules of engagement & authorisation

We do not send active test traffic without a signed authorisation from an individual with authority over every named target:

• Named targets only. Domains, IP ranges, repositories, cloud accounts, models, and agent environments are explicitly listed in scope. Anything not listed is out of scope.
• Self-owned and isolated labs first. Where an exploit primitive or variant class can be proven on a local or self-hosted reproduction environment at the matching version, we prove it there rather than risking production stability.
• Rate caps and prohibited actions. Request rates, test windows, and prohibited actions (such as denial-of-service or destructive state changes) are locked in writing before kickoff.
• Emergency stop. Both sides designate a direct point of contact. Testing halts immediately upon request at any point in the engagement.
• Third-party platforms. Hosted model providers, cloud vendors, and SaaS platforms are tested strictly within their published policies or under documented authorisation.

Multi-stage verification discipline

To protect engineering teams from false positives and speculative findings, our research and assessment workflow enforces three gates before a finding is reported:

• Causal confirmation. A vulnerability is only recorded when a deterministic signal reproduces, such as an executed nonce, a cross-identity authorization differential (Identity B reading a marker planted by Identity A), an out-of-band DNS/HTTP callback, or a browser DOM proof.
• Independent reproduction. Candidate findings are re-verified in a clean environment to confirm repeatability and document exact preconditions.
• Researcher sign-off. A security researcher reviews the evidence trace, severity rating, and remediation guidance before any report is delivered.

Evidence & data handling

Access and credentials

Credentials, API tokens, and source access provided for an engagement are stored strictly in encrypted, non-committed environment stores for the duration of the test window and revoked at close-out. We operate under mutual non-disclosure agreements and data processing agreements where required.

Minimisation and redaction

When demonstrating data-exposure or access-control vulnerabilities, we use canary markers or synthetic test accounts wherever possible. If real sensitive data or secrets are encountered during testing, we record only the location and metadata needed to prove the exposure, never the secret values themselves.

Retention and destruction

Engagement logs, HTTP traces, and reproduction artifacts are retained only for the duration of the engagement and any agreed retest window. At close-out, evidence stores are deleted or handed over in accordance with your written instructions.

Jurisdiction & compliance

Vantagea Ltd is incorporated in England and Wales (Company Number 14751439) and operates under UK data protection law, including the UK GDPR and the Data Protection Act 2018, outside the reach of the US CLOUD Act and FISA.

Findings are mapped to standard engineering and governance frameworks, including the OWASP Top 10 for LLM Applications, the OWASP Top 10 for Agentic Applications (ASI01 to ASI10), MITRE ATLAS, and CWE, so your team can use the deliverable directly in audit, procurement, and board packs.

Coordinated vulnerability disclosure

To report a security vulnerability in a Vantagea system or to coordinate disclosure regarding our research, email admin@vantagea.io with the subject line "Security Disclosure". We will acknowledge receipt promptly and coordinate remediation and disclosure timelines in good faith.

Contact

For security, scoping, or procurement questions regarding a current or proposed engagement:

Vantagea Ltd
Email: admin@vantagea.io

Company Number: 14751439
71-75 Shelton Street
Covent Garden
London, WC2H 9JQ
United Kingdom