Trust Center · Disclosure

Report it. We've got your back.

We welcome security research conducted in good faith. This policy tells you what's in scope, how fast we respond, and the safe-harbor terms that protect you when you follow it.

Revision 2026-06-13

How to report

Email security@tailroster.com with a clear description, reproduction steps, and the impact. PGP is available on request.

What's in scope.

In scope

tailroster.com (marketing site)
app.tailroster.com (the TailRoster application)
api.tailroster.com (the public API)

Out of scope

Social engineering of TailRoster staff, customers, or vendors (phishing, vishing, pretexting).
Physical attacks against offices, facilities, or hardware.
Denial-of-service (DoS/DDoS), volumetric, or resource-exhaustion testing.
Automated scanning that degrades service for other tenants.
Findings from third-party services we don't control (report those to the vendor).
Accessing, modifying, or exfiltrating data beyond the minimum needed to prove a finding.

Severity and response times.

Severity classes

Critical: Cross-tenant data access, authentication bypass, remote code execution.
High: Privilege escalation within a tenant, stored XSS affecting other users, exposure of secrets.
Medium: CSRF on a state-changing action, reflected XSS, insecure direct object reference with limited impact.
Low: Missing security headers with demonstrated impact, verbose error messages leaking non-sensitive detail.

Our SLAs

Acknowledge your report: 1 business day
Triage and confirm severity: 3 business days
Fix a confirmed critical issue: 7 days
Coordinate public disclosure (after a fix ships): by mutual agreement

Safe harbor.

Patterned on the disclose.io framework. If you make a good-faith effort to follow this policy:

We will not pursue or support legal action against you for security research conducted in good faith and in accordance with this policy.
We consider such research to be authorized under the Computer Fraud and Abuse Act (and equivalent laws) and exempt from our acceptable-use restrictions that would otherwise prohibit it.
We waive any claim against you under the DMCA for circumventing technical measures, to the extent your research follows this policy.
If legal action is brought against you by a third party for activity that complied with this policy, we will make it known that your actions were authorized.
Act in good faith: report promptly, don't access more data than needed, don't degrade service, and give us a reasonable chance to fix before any public disclosure.

Bounty schedule.

A funded cash bounty is not live yet — we don't advertise payouts we don't pay. Today, every researcher who reports a valid issue in good faith is credited in this hall of fame (with your consent) and gets a genuine thank-you from the team. When we fund a paid program, the critical / high / medium / low tiers will be published here.

Hall of fame.

No one's here yet — this list is empty because we credit only real, verified reports and haven't received one. Be the first: email security@tailroster.com.

See also /.well-known/security.txt · Last revised 2026-06-13