Responsible Disclosure

Report a security vulnerability

TBW welcomes reports of security weaknesses in TBW.com and in services TBW manages. Reporting is open to everyone. You do not need to be a customer.

Email [email protected] with the subject Security Vulnerability. This mailbox is for security reports only.

Scope

In scope

TBW.com and the subdomains that TBW operates.
Web applications, APIs and other services that TBW manages.

Out of scope

Systems that belong to or are run by a TBW customer. If you find an issue in a customer’s environment, please report it to that organization. If you are not sure who runs a system, email us and we will help route your report.
Third-party platforms and services, such as hosting, email, and AI model providers. Please report flaws in their products to the vendor. We do welcome reports about how TBW has configured or used them.
Social engineering, phishing of TBW staff or customers, and physical attacks.
Denial-of-service testing and high-volume automated scanning.
Findings with no demonstrated security impact, such as unvalidated scanner output or a missing best-practice header on its own.

If you are unsure whether something is in scope, ask before you test.

What to include

A clear summary of the issue and the affected URL, service or component.
Steps to reproduce, the behavior you expected, and what you observed.
The potential impact, as you understand it.
Relevant technical details, with sensitive information minimized or redacted.
A reply address so we can ask follow-up questions.
If you would like credit, the name you would like us to use. Tell us if you plan to publish your findings.

Please do not include passwords, private keys, customer data or exploit files in your first email. If we need sensitive evidence, we will agree a safer way to exchange it with you.

Good-faith research

To keep everyone safe, please:

Limit testing to the minimum needed to demonstrate the issue. Use your own accounts and test data where possible.
Avoid accessing, changing, deleting, keeping or sharing anyone else’s data.
Avoid disrupting services. Do not deploy malware, run denial-of-service attacks, or attempt to persist in or move through our systems.
Avoid social engineering and physical intrusion.
Avoid testing systems that TBW does not manage.
Stop testing and tell us promptly if you come across personal or other sensitive information.

What happens next

We review each report, contact you if we need more detail, assess the risk, and decide the appropriate next steps, which may include a fix or a mitigation. Where we can, we will let you know when the issue has been resolved.

Coordinated disclosure and confidentiality

We ask that you give us a reasonable opportunity to investigate and address the issue before you share details publicly, and that you keep any non-public information you encountered confidential. We will not ask you to sign a non-disclosure agreement in order to report an issue. If you plan to publish, please tell us, and we will work with you on timing.

How we handle your report

We use the information in a report to investigate, communicate about, fix and document the issue. We share it only with people and service providers who need it for those purposes. We will not publish your name or contact details without your permission. Please share only what is necessary.

Rewards

This page does not offer financial rewards or a bug bounty.

Last updated: 30 September 2026