1. How to report
E-mail security@tapfornetwork.com. The same address is published in tapfornetwork.com/.well-known/security.txt. We read reports in English.
2. What to include
What the problem is and where (the page or the address of the request); the steps to see it again; what an attacker could do with it; and how to reach you. Do not send other people's personal data: if you came across some, say so, and delete it.
3. What is in scope
tapfornetwork.com, the app and its address, and our API. Problems in the services of our providers (for example Clerk, Stripe, Cloudflare or an AI provider) belong to them: report those to them, and tell us if they affect TapForNetwork.
4. What is not allowed
Attacks that slow down or stop the service; automated scanning at a volume that our limits refuse; tricking people, including our staff; physical attacks; accessing, changing or deleting data that is not yours; keeping data longer than needed to show the problem; and asking for money in return for not publishing.
5. Our promise to people who report in good faith
If you follow this page, report to us first, and give us a fair time to fix the problem, we treat your research as allowed under our terms, we will not take legal action against you or complain to an authority about it, and we work with you to understand and fix the problem. We cannot speak for others, such as our providers or authorities.
6. What happens after you report
We confirm that we received your report, check it, and keep you informed while we fix it. When it is fixed, we tell you.
7. Publishing what you found
Please wait until the problem is fixed before you publish anything, and agree the date with us. We ask for up to 90 days; if the problem is being exploited, we work faster.
8. Rewards
We do not pay rewards today. With your permission, we thank you by name when the problem is fixed.
9. How we protect your data
Encrypted connections, sign-in through a specialist provider, accounts kept apart from each other, short-lived download links, daily encrypted backups in separate, locked storage, and operators who work in a separate console with its own sign-in in two steps, which never shows the people in our users' networks, their notes or their messages and records every action. Our Security page gives the details, and the privacy notice says how long we keep what.
10. If something goes wrong
If a breach puts personal data at risk, we tell the competent data protection authority within 72 hours of learning of it, where the law requires that, and the people affected without undue delay when the risk to them is high.
What changed in this version
- Says that our operators work in a separate console with its own sign-in in two steps, which never shows the people in our users' networks, their notes or their messages.