vesim.shop
Security

Nothing to steal is the best lock.

No accounts, no passwords, no payment details. What you save stays on your device, and a photo search sends 64 bits. If you find a hole anyway, here is how to tell us, and what we promise in return.
Report a vulnerabilityWhat we store
Everything we hold per photo · 64 bits
Responsible disclosure

Found something? Email it, then wait for us.

Write to hello@vesim.co with the subject “Security”. Include what you found, where, the steps to reproduce it and what an attacker could do with it.
1

We acknowledge it

Within 2 working days, from a person, with a note of what we understood.
2

We keep you posted

An update at least every 7 days until it’s fixed, and a note when it is, so you can check the fix.
3

You go public after

Please give us a reasonable time to fix it before you publish; 90 days is the default, sooner once it’s fixed. We’ll credit you if you’d like.

In scope

  • vesim.shop and every page on it
  • The app at vesim.shop/a
  • Our API routes: /api/search, /api/extract, /api/img and /api/match
  • The Vesim browser extension

Out of scope

  • Seller and store websites we link to
  • Our hosting provider's own infrastructure
  • Denial of service, load or volume testing
  • Social engineering, phishing or physical attacks
  • Scanner output with no demonstrated impact
  • Spreading requests across many IPs to beat a rate limit
Safe harbour

Act in good faith, and we’re on your side.

If you
  • test only what’s in scope,
  • don’t degrade the service for anyone else,
  • stop and tell us if you reach data that isn’t yours,
  • and give us time to fix it before you publish,
Then we
  • won’t take legal action against you for that research,
  • won’t report you to your provider or anyone else,
  • won’t treat it as a breach of our terms,
  • and will work with you on the fix and the write-up.

We don’t run a paid bug bounty yet. We’re a small company and would rather say so than promise a reward we can’t pay. This covers our own systems only; we can’t authorise testing of a seller’s site or our host.

What we store

Almost nothing. Here is all of it.

The same facts as the privacy policy, laid out as an attacker would look at them.
Accounts, passwords, emails
None exist. There is nothing to sign in to.
Payment details and addresses
Never collected. We sell nothing and run no checkout.
Saved items, lists, watches, history, settings
In your browser, on your device (IndexedDB, or localStorage as a fallback). Never sent to us.
A photo you search with
Fingerprinted on your device. Only 64 bits are sent, never the image.
A link you paste
Our server fetches that page once to find its main image, through a guard that refuses private and internal addresses.
Standard request logs
Our host keeps IP, browser and page requested in short-lived logs, for security and reliability.
Try it · what leaves your device

Make a fingerprint. Watch it not leave.

This runs the same fingerprint code as photo search and the extension, here in your browser. It shows the 64 bits and the exact request photo search would make, and sends nothing.

Showing a fingerprint from the index until you choose a photo.

A photo, as it leaves33b66f5b220491f264 bits. Not reversible into a picture.
The whole request photo search sends
POST /api/match
{
  "phash": "33b66f5b220491f2",
  "askingPrice": null,
  "limit": 12
}
Rate limits

Fair use, enforced per minute.

The routes that fetch from the internet or answer lookups are limited per client, per minute. Over the limit you get a 429 with a Retry-After header, and it clears on its own.
/api/extract20requests / minuteFetches a pasted link's page to find its image
/api/img60requests / minuteProxies an image so it can be fingerprinted in your browser
/api/match120requests / minuteLooks up a 64-bit fingerprint

Limits are counted on each server instance, so the ceiling across the whole service is a small multiple of these numbers. That’s enough to stop a runaway script; please don’t test how far past it you can get. Search requests to our catalogue partner are also queued to one a second, which is why a new search can take a moment.

Nothing to sign up for

No account. Just ask.

Search without giving us anything: no email, no password, no card. What you save stays on your device.
Report a vulnerabilityOpen the app Get Plus