Security Policy

This policy applies to tapeboard.com and its subdomains. Hosts not operated by Tapeboard, including third-party services we integrate with, are out of scope.

Report security vulnerabilities in our web application and API: authentication or session handling flaws, access-control gaps, injection bugs, exposure of user or payment data, or anything else that could harm our users or their data. Do not report styling bugs, missing features, or issues in third-party services.

Email [email protected] with [security] in the subject line. Include a description of the issue, the affected URL or endpoint, and the steps needed to reproduce it. Public posts, social media, or mailing lists about an unreported issue do not reach us.

We will not pursue legal action against researchers who interact only with accounts and data they own or that we provide, avoid privacy violations and data destruction, do not degrade service availability, and give us reasonable time to fix the issue before any public disclosure.

We do not currently pay bounties for vulnerability reports. Reports are welcomed anyway.

We acknowledge and triage reports on a best-effort basis. We do not commit to a service level agreement (SLA) for acknowledgement or fixes, but every serious report gets a human response.