Company pages
Vulnerability disclosure
How to report a security problem in talonlabs.dev, its licence service, or Talon Studio — what is in scope, what we ask of you, what you can expect from us, and our promise not to pursue good-faith research.
How to report
Email security@talonlabs.dev. Tell us what you found, where (the URL, or the product and its version), the steps that reproduce it, what an attacker could do with it, and how to reach you. A proof of concept helps; a working exploit against someone else's data does not.
We do not publish an encryption key yet. If your report needs one, say so in a first message without the details, and we will arrange it. Please do not use the contact form or the support address for a vulnerability.
Scope
What we ask of you
What you can expect
Safe harbour
If you make a good-faith effort to follow this policy, we will treat your research as authorised. We will not bring or support legal action against you for it, under computer-misuse law or otherwise. For that research, we waive the restriction on probing the site in section 3 of the Terms of Service, and sections 3(c) and 3(d) of the Community Edition Licence (working around licence checks, and reverse engineering) — this policy being our written permission for that research and nothing more. If someone else brings action against you for research that followed this policy, we will make it known that it was authorised.
This covers research into our site and our software, not the services of the providers we use, and it does not cover using what you find for anything but reporting it to us.