alt Hacker News> November 3, 2025: Reported.
> November 10, 2025: No response, followed up.
> November 17, 2025: No response, followed up and copied some additional people on the thread.
> November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed.
> July 27, 2026: Published
Quite the generous timeline on this person's behalf.
And terrible (non-)response from VECV, if they have any interest in receiving timely disclosure from future researchers.