Vulnerability disclosure policy

Email security@tapquality.com. Tell us what you found, where, and the steps to see it. Include the time and your contact details. Keep the report free of any real personal data you came across.

The tapquality.com website and its subdomains, including the web application and the API.

• Services run by other companies, such as our identity, hosting, email and telephony providers. Report those to the provider.
• Denial-of-service and load testing.
• Social engineering, phishing, or attacks on our staff, partners or customers.
• Physical access to any office or device.
• Reports from automated scanners with no demonstrated impact.
• Missing security settings that have no demonstrated effect.
• Any action that places real phone calls or causes real spend.

• Do not access, change, copy or keep another customer’s data. If you reach data that is not yours, stop and tell us.
• Do not disrupt the service or slow it for others.
• Do not use social engineering.
• Do not share details publicly until we have fixed the issue or agreed a date with you.
• Use only your own accounts for testing.

If you act in good faith and follow these rules, we will treat your research as authorized. We will not start legal action against you or ask law enforcement to do so for that research. We cannot speak for other companies. If you are unsure whether something is allowed, ask us first.

We will acknowledge your report within 3 business days. We will keep you informed, tell you our decision, and tell you when the issue is fixed. We will credit you if you want that. We do not currently run a paid bounty program.