Tarosyn Legal

Vulnerability Disclosure Policy

Last updated May 31, 2026

Tarosyn LLC welcomes the work of security researchers who help keep our platform and users safe. This Vulnerability Disclosure Policy ("Policy") explains how to report security vulnerabilities to us responsibly, what systems are in scope, and the protections we extend to researchers who act in good faith.

1. in-scope targets

The following Tarosyn-owned systems and surfaces are in scope for responsible disclosure:

Tarosyn web application — tarosyn.app and tarosyn.com (all sub-paths) Tarosyn REST API — authenticated and unauthenticated endpoints served under the same origin Tarosyn iOS app (App Store listing: com.tarosyn.app) Tarosyn Android app (Play Store listing: com.tarosyn.app) Authentication flows — email/password, Google OAuth, Sign in with Apple, and native SIWA Account and payment flows — subscription management, Luna credits, and in-app purchases User-generated content surfaces — Chant Feed, DMs, circles, and reading sharing Administrative and moderation routes that require elevated privileges

2. out-of-scope targets

The following are explicitly out of scope. Testing against these systems may result in your report being declined and could expose you to legal risk:

Third-party services we depend on (Stripe, OpenAI, SendGrid, Apple, Google) — report issues directly to those providers Social engineering or phishing attacks targeting Tarosyn employees or users Physical security of our infrastructure or offices Denial-of-service attacks (network flooding, resource exhaustion via brute-force) Automated scanning that generates excessive load on production systems Vulnerabilities that require physical access to a victim's device Theoretical vulnerabilities without a working proof of concept Issues in dependencies where the upstream fix has already been published and we have not yet deployed it — file a standard bug instead The mockup sandbox or any code path not reachable in the production environment

3. how to report

The fastest, most reliable way to disclose a vulnerability is the report form below — it logs your finding directly with our security team, sends you an automatic confirmation email with a reference number within minutes, and starts the acknowledgement clock immediately. If you prefer email, you can also write to [email protected] as a fallback; emailed reports are monitored but may take slightly longer to acknowledge than form submissions.

Include as much of the following as possible:

A clear description of the vulnerability and its potential impact The affected URL, endpoint, or app surface Step-by-step reproduction instructions — the more precise, the faster we can verify and fix Screenshots, HTTP request/response captures, or a video walkthrough if helpful Any proof-of-concept code, limited strictly to demonstrating the issue (not exploiting it) Your preferred contact method and whether you would like to be credited in our acknowledgements

Please encrypt sensitive details using our PGP key if you are concerned about transmission security — key available on request via the address above.

4. response timeline

We commit to the following response targets after receiving a valid report:

Acknowledgement — within 3 business days of receipt Initial triage and severity assessment — within 7 business days Resolution target for critical or high-severity issues — within 30 days of triage Resolution target for medium-severity issues — within 60 days of triage Resolution target for low-severity or informational issues — within 90 days of triage, or at our next scheduled maintenance window We will notify you when the issue is resolved and, with your permission, credit you in our public acknowledgements

If a fix requires coordination with a third-party vendor or regulatory disclosure, timelines may extend beyond the targets above. We will keep you informed of any significant delays.

5. safe-harbor commitment

Tarosyn will not pursue civil or criminal action against researchers who discover and report vulnerabilities in good faith and in accordance with this Policy. Specifically, we commit that:

We will not initiate legal action for security research conducted within this Policy's scope We will not file a complaint with law enforcement over good-faith research We will work with you to understand and confirm the issue before taking any action We consider good-faith research to be authorised access for the purposes of the Computer Fraud and Abuse Act (CFAA) and equivalent laws in other jurisdictions We will acknowledge your contribution if you wish, once the vulnerability is resolved

Good faith requires that you: (a) limit your testing to what is necessary to confirm the vulnerability; (b) avoid accessing, modifying, or exfiltrating user data beyond what is necessary; (c) do not exploit the vulnerability for personal gain or disclose it publicly before we have had a reasonable opportunity to fix it; and (d) cease testing and notify us immediately if you encounter user data unexpectedly.

report a vulnerability

Submit your finding here for the fastest response. You'll get an automatic confirmation email with a reference number within minutes, and our team acknowledges every credible report within 3 business days.

Your email Affected surface Web app (tarosyn.app / tarosyn.com) Web app (tarosyn.app / tarosyn.com)

REST API

iOS app Android app Authentication / sign-in flows Payments / subscriptions / Luna User-generated content (Chant, DMs, circles, sharing) Admin / moderation routes Other / not sure Severity (your estimate) Not sure — please triage Critical — full account/data compromise, RCE High — privilege escalation, auth bypass Medium — limited data exposure, CSRF Low — informational, hardening Not sure — please triage Affected URL or endpoint (optional) Description, impact & reproduction steps I'd like to be credited in your public acknowledgements once this is resolved. Submit report bug bounty

Tarosyn currently operates a community Bug Bounty programme through which approved reports earn Luna credits. Financial rewards for externally reported security vulnerabilities are evaluated on a case-by-case basis. We do not commit to a paid bounty for every valid report; our primary reward is responsible credit, a thank-you note, and — for critical findings — a good-faith gesture at our discretion.

For general app bugs (crashes, UI issues, unexpected behaviour), please use our in-app Bug Bounty programme instead of this policy.

changes to this policy

This Policy may be updated from time to time. The date at the top of the page reflects the most recent revision. We will notify researchers with active reports of any material changes that affect their submission.

See our credited researchers (acknowledgements) Read our Information Security Policy See our Security overview

Security disclosures? [email protected]