Vulnerability Disclosure Policy

Last updated 25 October 2026

We want to hear about security issues in anything TrustArk operates.If you report in good faith under this policy, we will work with you, credit you if you wish, and not pursue legal action.

Look closely. If you find something, tell us and we will work with you.

1. How to report

Email security@trustark.io with the subject "Security". Include what you found, where, steps to reproduce, and the impact you expect. Screenshots or a short video help.

2. Scope

In scope: trustark.io and its subdomains, and any document links we have sent you.

Out of scope: denial-of-service testing, social engineering of our team or partners, physical attacks, automated scanning that generates heavy traffic, and issues in third-party services we do not control (please report those to the provider).

3. Rules of engagement

Only test against accounts and data you own. Stop and tell us as soon as you encounter personal or confidential information, and do not keep, share, or change it. Give us reasonable time to fix an issue before disclosing it publicly.

4. What you can expect

A person will acknowledge your report, keep you informed while we investigate, and tell you when the issue is resolved. We do not currently run a paid bug bounty.