Vulnerability disclosure
Found a security issue in Tanqory? Tell us and we will work with you to fix it. Our disclosure program is open now. Paid rewards begin when the bounty portal launches; reports sent before then are welcome but are not paid.
Updated
- To acknowledge your report (business hours)
- 24 h
- To confirm severity and scope (business days)
- 5 days
- Target to fix a critical issue
- 14 days
- AcknowledgedWithin 24 business hoursDone
- AssessedSeverity and scope in 5 business daysNow
- FixedCritical 14 days, high 30, medium 60Next
- PublishedOn a date agreed with youLater
How to report
Write to our security team with what you found and how to see it again. A person reads every report and replies within 24 business hours.
- Affected addressA URL or the app version
- Steps to reproduceFrom your own test account
- ImpactWhat an attacker gains
- ProofShows the flaw, does no damage
Reply within 24 business hours.
- Write to usAt security@tanqory.com, naming the affected address or app version.
- Show the impactSteps to reproduce, what an attacker gains, and a proof that does no damage.
- Test safelyUse your own test accounts and made-up data, keep under 5 requests a second, and stop when you see HTTP 429.
In scope
- Production sites on *.tanqory.com
- Public REST and GraphQL APIs
- The official iOS and Android apps
- Checkout, sign-in and account flows
- The admin and the merchant and partner portals
Out of scope
- Other companiesFlaws in Cloudflare, AWS, Stripe and other providers: report them to the provider.
- People and placesSocial engineering, phishing and physical attacks.
- LoadDenial of service and anything that degrades the service.
- Real dataReading, changing or keeping data that is not yours.
- Low impactScanner output, version banners, SPF, DKIM or DMARC settings, self-XSS and clickjacking on static pages.
What happens next
- AcknowledgedWithin 24 business hours.
- AssessedSeverity and scope confirmed within 5 business days, then news at least every 14 days.
- FixedTargets: critical 14 days, high 30, medium 60, low in a planned release.
- PublishedWe agree a disclosure date with you, as our disclosure policy sets out.
Safe harbor
If you act in good faith and within this policy, we will not take legal action against you for your research. Safe harbor does not cover extortion, selling what you find, or testing that local law requires separate permission for.
Rewards
Paid rewards are planned for when the bounty portal launches. The amounts will be set out in our Bug Bounty Policy at launch. Nothing is paid before then.
Policies and documents
- Vulnerability Disclosure PolicyHow researchers, customers and partners can report suspected security vulnerabilities in Tanqory products.Updated
- Bug Bounty PolicyRules for security researchers who test Tanqory and report vulnerabilities in return for rewards.Updated
- Incident Response PlanHow Tanqory detects, contains, recovers from and notifies about security incidents such as data breaches.Updated
Questions
Who can take part?
Anyone 18 or older who is not under sanctions, has not worked for Tanqory in the last 12 months, and is not close family of someone who has.
Can I stay anonymous?
Yes. We credit you only if you agree, under the name you choose.
More in the trust center
Found a security issue?
Write to security@tanqory.com with the steps to reproduce it. We acknowledge every report within 24 business hours, keep you posted while we fix it, and never take legal action against research done in good faith under our disclosure policy.