Report a security vulnerability

Report a security vulnerability

We appreciate the work of security researchers. If you believe you have found a vulnerability in a TapMind system, please tell us, and we will work with you to understand and resolve it quickly.

How to report. Email security@tapmind.com with: a description of the issue and where it is; steps to reproduce (a proof of concept is welcome; please do not include real personal data); the impact you believe it has; and how we can reach you. Our machine-readable contact details are at tapmind.com/.well-known/security.txt.

What is in scope. tapmind.com and its subdomains; the TapMind platform; TapMind's serving and telemetry endpoints; the TapMind SDK and its adapters; the TapMind display tag and video player. Out of scope: third-party services and partners' systems (report to them directly); denial-of-service or volumetric testing; social engineering, phishing or physical attacks; automated scanning that degrades service; issues that require a compromised device or account; reports of missing best-practice headers without a demonstrated impact; findings in apps or websites that merely include our software (report to the publisher).

What we ask of you. Act in good faith: access only the minimum data needed to demonstrate the issue, do not access, modify or retain personal data belonging to others, do not disrupt service, and give us reasonable time to remediate before any public disclosure. We ask for at least 90 days from acknowledgement, or longer for complex fixes by agreement.

What you can expect from us. We will acknowledge your report within 5 business days, keep you informed of our progress, and tell you when the issue is resolved. We will not pursue legal action against researchers who follow this policy in good faith, and we will not refer such research to law enforcement. If you comply with this policy, we consider your research authorised for the purposes of applicable anti-hacking and anti-circumvention laws to the extent we are able to authorise it. We do not currently operate a bug-bounty programme and do not offer rewards, but with your permission we will credit you when a fix is published.

Personal data. If you encounter personal data during your research, stop, do not retain it, and tell us in your report. We process the contact details you give us only to handle your report, under our Privacy Policy.

Thank you for helping keep TapMind's publishers and their users safe.