> November 3, 2025: Reported.
> November 10, 2025: No response, followed up.
> November 17, 2025: No response, followed up and copied some additional people on the thread.
> November 20, 2025: It was no longer possible to access any of the internal APIs. The primary vulnerability was now fixed.
> July 27, 2026: Published
Quite the generous timeline on this person's behalf.
reminder, these vendors like Volvo etc., don't really want you to report vulns, you should just sell them to a broker instead and get some actual money as well, it's a win win.
And terrible (non-)response from VECV, if they have any interest in receiving timely disclosure from future researchers.