Please report suspected vulnerabilities privately. Do not open a public issue or include private keys, credentials or guest information in a public report.

• Protocol, schemas and conformance artifacts: vrp-spec security policy.
• Verifier package: vrp-verify security policy.

For a concern involving this organization profile or when the affected repository is unclear, email security@vacationrentalprotocol.com with VRP SECURITY in the subject. Include the affected repository or URL, the observed impact and reproduction steps using non-sensitive examples.

Each repository's own security policy takes precedence over this shared fallback. Product or individual host-domain issues should be reported to their operator.