Report a security issue

How to report

• Email security@tacy.io.
• Say what you found, how to reproduce it, and what someone could do with it. A short proof of concept helps.
• We aim to reply within five working days, and to keep you updated until it's fixed.
• Our contact details are also in security.txt.

What's in scope

• tacy.io and chat.tacy.io, including the app's API.
• The code in tacyhq/tacy: the agent machine, the verifier your browser runs, and how releases are built and signed.
• We most want to hear about anything that lets anyone, us included, read someone's content, get past the browser's hardware check, run an unsigned release, take a key, or get data out without the person's say.

What's out of scope

• Weaknesses in our providers' own services (see the list). Report those to them; tell us too if it affects Tacy.
• Denial of service, load testing, spam, and social engineering or phishing of anyone.
• Reports from automated scanners with no shown impact.

Please

• Test only with accounts you own. Don't access, change or delete other people's data.
• If you reach someone else's data by accident, stop, don't keep it, and tell us.
• Don't degrade the service for others.
• Give us a reasonable time to fix the issue before you publish, normally 90 days. We'll agree a date with you.

Safe harbor

If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or report you to law enforcement for it. If someone else does, we'll make it known that you acted under this policy.

We don't pay bounties yet. With your permission, we'll thank you by name when the fix ships.