Report a vulnerability

1. How to report

If you believe you have found a security vulnerability in TrustProof, please email security@trustproof.tech with a description of the issue, the affected URL or feature, the steps to reproduce it and the impact you observed. Please report privately, not through social media, reviews or public forums.

2. Scope

In scope: the trustproof.tech website and the TrustProof application, using an account you created yourself for testing.

Out of scope:

• Our customers' AWS accounts, systems and data. Never test or access them.
• Third-party services we use, such as our payment provider and our cloud provider. Report issues in those to the provider directly.
• Denial-of-service, load or high-volume automated testing.
• Social engineering, phishing or physical attacks.
• Reports without a demonstrated security impact, such as missing headers or email settings on their own, version banners, or self-XSS.

3. Rules for testing

• Only test against accounts and data you own.
• Don't access, change, delete or keep anyone else's data. If you come across personal or customer data, stop, report it to us and don't keep a copy.
• Don't degrade the service for other users.
• Give us reasonable time to fix an issue before you share any details publicly. Unless we agree otherwise, please wait 90 days from your report, or until the fix is released if that is sooner.

4. What we will do

We aim to acknowledge your report within five business days, keep you informed while we investigate, and let you know when the issue is resolved. With your permission, we are happy to credit you for a valid report.

We will not take legal action against anyone who reports a vulnerability in good faith and follows this policy.

5. Rewards

TrustProof does not run a paid bug bounty program and does not offer monetary rewards for reports. Requests for payment as a condition of disclosing a finding will not be accepted.