Report a Vulnerability
Effective 26 October 2026
If you believe you have found a security vulnerability in Truvasse, this page explains how to report it privately and what to expect after you do.
How to Report
Send a private report to hello@truvasse.com with the subject line marked “Security”. Include the affected URL/component, steps to reproduce, impact, and supporting evidence. Do not include unnecessary personal data.
Good-Faith Testing
Do not access or modify another user's data, perform denial-of-service, use social engineering, send spam, install persistence, exfiltrate data, or test third-party systems outside Truvasse's control. Stop when you have enough information to demonstrate the issue.
Our Process
We will acknowledge and triage reports as operational capacity allows, investigate reproducible issues, and coordinate remediation. We may request additional information. Do not publicly disclose an unremediated issue until coordinated disclosure is agreed or legally required.
No Bug Bounty Promise
This policy does not create a promise of payment or a bug-bounty program. Any reward is discretionary unless Truvasse publishes separate written bounty terms.