Terravek has published statistics for its coordinated vulnerability disclosure programme covering 2025. Thirty-one reports were received at security@terravek.com, of which eight were valid and remediated, three were accepted as risk with reasoning shared with the reporter, eleven were out of scope and nine were duplicates.
Median time to first response was 11 hours against a published 72-hour commitment; median time to fix was 19 days.
The disclosure policy is published at /.well-known/security.txt. Terravek does not operate a paid bounty and does not require reporters to sign a non-disclosure agreement.