Security & Responsible Disclosure
Effective date: 03/09/2026
Velanique Global Sourcing Limited welcomes reports of potential security issues affecting our website. This page explains how to report a concern, what information helps us assess it, and how we coordinate a response while protecting people and business information.
Velanique Global Sourcing Limited is registered in Bangladesh and Canada. Both operations are responsible for this website and receive security concerns through the reporting route below.
Report a website security issue
Email team@velaniqueglobal.com with the subject “Security report — brief issue summary”.
Send a concise description and the affected website address. Do not include passwords, authentication tokens, payment details, confidential client files or unredacted personal information. If sensitive evidence is necessary, describe its nature and request an appropriate transfer method first.
For questions about your personal information, use the contact instructions in our Privacy Policy. For sourcing, orders or general website feedback, use our Contact page.
What this reporting process covers
We receive reports about potential security weaknesses affecting the public website at velaniqueglobal.com, including website forms, content exposure or integrations presented on that site.
A report may concern an issue in our website configuration or a service supplied by another provider. We assess which organization is responsible and, where appropriate, coordinate with the relevant provider.
This reporting scope does not automatically include other domains, subdomains, employee devices, factory systems, client systems or third-party infrastructure.
Permission for security testing
You may report an issue encountered during ordinary, permitted use of the website. This policy does not grant permission for active security testing.
Before scanning, probing, attempting exploitation or carrying out other active testing, obtain written authorization from the relevant system owner. Any authorization must identify the assets, methods and boundaries permitted.
We cannot authorize testing of Framer's platform, another customer's website, a hosting provider or other third-party systems. Receiving a report or acknowledging it does not grant or expand testing permission.
Protect people and information
When reporting an issue or carrying out separately authorized work:
- Avoid disruption, excessive requests or interference with website availability.
- Do not access, change, download or disclose information you are not authorized to use.
- Do not use phishing, impersonation, password attacks, malware or attempts to establish continuing access.
- Do not contact our clients, suppliers or employees to demonstrate an issue or obtain information through deception.
- Use only the minimum, redacted evidence needed to describe the concern. Do not continue testing simply to establish a greater impact.
…
If you unexpectedly encounter personal information, credentials or confidential business material, stop immediately. Do not access additional records or share the exposed information. Report the location and nature of the exposure without including the sensitive material itself.
What to include in your report
A useful report includes:
1. The affected URL, feature or page.
2. A clear description of the suspected weakness and its potential impact.
3. The steps that led to your observation, with the date, time and relevant browser or device details.
4. Redacted screenshots or other minimal evidence already available from permitted activity.
5. Whether you believe information is currently exposed or the issue is being actively exploited.
6. A way to contact you for clarification, if you are comfortable providing one.
…
You do not need to reproduce an issue again, access another person's data or conduct additional testing to submit a report. Clearly distinguish an observed effect from a theoretical concern.
How we handle reports
Our process is to review the report, assess potential impact, identify the responsible system or provider and determine appropriate next steps. We may ask for clarification or information already available to you; do not treat such a request as authorization for further testing.
Where contact details are provided, we aim to acknowledge receipt and provide meaningful updates as the assessment progresses. Issues involving exposed information, active abuse or significant disruption receive priority.
Response and remediation times depend on severity, complexity and any provider involvement. We do not promise a fixed resolution date or disclose information that could put people or systems at further risk. If you have not received a response, follow up on the original email thread with the date of your first report.
Coordinating public disclosure
Please contact us before publishing details that would make an unresolved issue easier to exploit. We seek to agree a reasonable disclosure timeline that considers the impact, available mitigations and any affected providers.
If coordination stalls, a recognized vulnerability coordinator may be able to help. This process does not restrict lawful reports to regulators, law enforcement or other competent authorities.
Avoid publishing personal information, credentials or confidential business material. We will ask for your permission before naming you publicly in connection with a report.
Rewards, privacy and legal limits
Submitting a report does not create an entitlement to payment, a bounty or another reward. Any reward must be covered by a separate written agreement.
We use report information to assess the issue, communicate with you and coordinate necessary remediation, as described in our Privacy Policy. Relevant technical details may be shared with providers or advisers involved in resolving the issue, with personal information limited to what is needed.
We appreciate reports made honestly to help protect users. This page does not provide blanket legal immunity or permission to disregard applicable law or a third party's rights. Any protection or authorization for a testing engagement must be addressed in the written terms for that engagement.
Products
Company
Contact
2411 McLeod Ave, Richmond, BC, Canada