Report a security weakness
On this page
Found a vulnerability in a Tanqory site, app or API? Tell us under the Vulnerability Disclosure Policy and we confirm within 1 business day, set the severity within 5, and keep you updated at least every 14 days until it is fixed.
Test only with your own accounts and keep it non-destructive: no denial of service, spam, phishing, credential stuffing or social engineering. If you reach personal data by accident, stop, do not keep it, and say so here. Research done this way is welcome, and we will not take legal action against you for it.
Remove secrets, tokens and other people’s data from what you send. You can attach redacted screenshots to the email.
Your notice
After you send it
- Your report reaches security@tanqory.com and we confirm within 1 business day.
- Within 5 business days we confirm severity and scope, then update you at least every 14 days.
- We fix critical issues within 14 days, high within 30 and medium within 60, sooner if it is being exploited.
- Once it is fixed, we agree on disclosure with you, and we may credit you if you ask.