Security at TechTape

We take the security of our platform and our customers’ data seriously. This page explains how to report a security issue to us and what you can expect in response.

Reporting a vulnerability

Email security@gettechtape.com.

Please include:

• A description of the issue
• Steps to reproduce it
• The affected component, endpoint or URL
• Any proof-of-concept, screenshots or logs

If your report contains sensitive data, say so and we will arrange an encrypted channel before you send it.

What to expect

Scope

In scope

• api.gettechtape.com
• portal.gettechtape.com
• The TechTape API and customer portal

Out of scope

• Third-party services we integrate with. Please report those to the respective vendor
• Social engineering of our staff or customers
• Physical security
• Denial-of-service testing
• Reports generated solely by automated scanners without a demonstrated impact

Safe harbour

We will not pursue legal action against security researchers who:

• Act in good faith and avoid privacy violations, data destruction and service disruption
• Access only the minimum data necessary to demonstrate the issue
• Do not exfiltrate, retain or share customer data
• Give us reasonable time to remediate before public disclosure

If you follow these guidelines, we will treat your research as authorised and work with you to understand and resolve the issue.

How we handle what you report

Reported issues are triaged against the same remediation targets as internally discovered vulnerabilities:

Severity follows CVSS v3.1, adjusted for exploitability in our deployment context.

Contact