1. How to report
Email security@transynq.io with a description of the issue, the steps to reproduce it, the affected URL or component, and any proof of concept. Please include how we can reach you.
Report as soon as you can after finding the issue, and keep the details confidential until we have fixed it.
2. In scope
The following are in scope:
- The Transynq web application and its API.
- The Transynq driver app for iOS and Android.
- The public website at transynq.io.
3. Out of scope
Please do not test or report the following:
- Denial of service, load testing or anything that degrades the service for others.
- Social engineering, phishing or physical attacks against Transynq staff, customers or offices.
- Services run by third parties, such as Microsoft Azure, Twilio or Google. Report those to the provider.
- Findings from automated scanners without a demonstrated impact, missing best-practice headers with no exploit, and issues that need a compromised device or browser.
4. Rules of engagement
When you research a possible vulnerability:
- Use only accounts you own or have permission to use, and never access, change or delete another customer's data.
- If you reach customer data by accident, stop, do not keep a copy, and tell us immediately.
- Do only what is needed to show the issue exists.
- Do not publicly disclose the issue until we have confirmed it is fixed, or 90 days have passed since your report, whichever comes first, unless we agree otherwise.
5. What we promise
We will acknowledge your report within 2 business days, tell you whether we have confirmed the issue, and keep you updated until it is fixed. With your permission, we will credit you once the fix is released.
If you act in good faith and follow this policy, we will consider your research authorised, we will not pursue or support legal action against you, and if a third party takes action against you for research under this policy, we will make it known that you acted with our authorisation.
6. Rewards
Transynq does not run a paid bug bounty programme at this time. We are grateful for every report and will credit researchers who want it.