Found something? Tell us here.

If you follow this policy, TRVUE will not pursue you. We will not bring or support a legal claim against you over the research described here, we will not report you to law enforcement, and we will not approach your employer, your university or your hosting provider to have you dealt with elsewhere.

No party is named behind this commitment yet. TRVUE is not currently a registered company, and an assurance signed by a brand rather than by someone you could hold to it is worth less than it looks. Until an operator is named here, weigh it accordingly — we would rather you knew that than found out later.

We treat testing that follows this policy as authorised access to our systems. If anyone else raises a question about research you carried out under it, we will say that plainly, in writing, to whoever is asking.

Two limits, stated rather than buried. This commitment is given by the operator of TRVUE about TRVUE's own systems — nobody can waive a third party's rights, so the services listed under what is out of scope are not ours to authorise. And it rests on good faith: a report that arrives as a demand for payment, or research that destroyed or took other people's data, is not covered by it.

This list was read out of the code rather than copied from a template. Every row is a surface that exists in the platform today.

Card details never reach TRVUE — the card is entered on the payment provider's own hosted page. How TRVUE hands off to that page, and what it does with the result, is ours and is in scope.

The contracts are in scope as source. Nothing in this repository is deployed to a public chain — the only deployment record is a local test one — so a finding there is a finding about code, and we would rather have it before that changes.

Not because these do not matter, but because we cannot act on them, or because they tell us nothing we could fix.

• Anything belonging to someone else: the payment provider's hosted pages, the email service, the hosting platform, and the public chain endpoints this app reads from.
• The demo corpus. The companies, campaigns and people that ship as sample data are fiction, so exposing a fictional record is not an exposure.
• Volumetric denial of service, load testing, and any finding whose proof is that the server got slower.
• Scanner output on its own: a missing header, a library version, a TLS grade or a mail record, with nothing demonstrated to follow from it.
• Social engineering, phishing, physical access, and anything aimed at an operator's personal accounts or devices.
• Self-XSS, clickjacking on a page with no action worth hijacking, and issues that need a device or browser which is already compromised.
• Mass account creation, and flooding this report form.
• What the browser extension displays on third-party block explorers. The pages it annotates are not ours; how it talks to our API is.

The short version: use your own accounts, stop at proof, and leave nothing behind.

You may

• Register your own accounts and test against them, including a company and a campaign you created yourself.
• Read the source. This platform describes its own behaviour in the open, and reading it is not an intrusion.
• Use the payment provider's test cards and your own wallet addresses.
• Automate enough to demonstrate a flaw — not enough to become a load test.

Please do not

• Access, change, keep or publish anyone else's data. If you land in someone's data by accident, stop, and tell us what you saw so we can measure the exposure.
• Move money, alter a campaign you do not own, or change another account's credentials — even to prove that you could.
• Deface anything, or leave a payload behind. If your proof needs one, remove it and tell us where it was.
• Ask for payment in return for withholding a finding. There is no bounty here, and a report that arrives as a price is not a report.
• Publish before we have had a chance to fix it. We cannot promise you a date, so tell us when you intend to publish and we will tell you where we are.

There is no security mailbox, because an address nobody reads is worse than none — the silence would look like indifference rather than an empty inbox. This form is the channel, and what it writes lands in a queue an operator reads.

Contact details are optional. A report with no way to reach you is still read and still acted on; you simply will not hear back.

It is stored exactly as you typed it. Nothing rewrites, strips or tidies the text — a proof of concept that arrives mangled is not a proof of concept — and it is displayed as plain text, never as markup.

Your IP address, your browser and any session are not stored beside it. The address is used once, to enforce a rate limit, and then dropped. If you report anonymously, nothing on the record identifies you.

The moment your report is stored you get a reference code on screen. It is how an operator finds your report if you write to us again. It is shown once and never emailed, so copy it before you leave the page.

We commit to this: the form tells you on screen that your report was stored and gives you a reference, an operator reads the queue, and if you left contact details and asked for an update, you will get one.

We do not commit to a time. TRVUE has one operator, no rota, and nothing that wakes anybody at night — and a response time is only worth publishing if somebody can be held to it, which is what the contact page says about every other channel here. So this page names no number rather than a number nobody stands behind.

There is no bug bounty. No budget is set aside for one, and inventing a reward we cannot pay would be worse than saying so plainly. If you want credit for a finding, we will use whatever name you give us; if you would rather we said nothing, we will say nothing.

No acknowledgement window is published, because transactional email is not configured on this deployment and nothing alerts anyone when a report arrives. Promising a response time against a queue nobody is paged for would be a commitment in name only. The window appears here automatically once email is configured.

Credit

If we fix something you reported, we credit you by name — by default, and without you having to ask. Tell us the name you want used, or tick the box on the form to stay anonymous. There is no bounty: TRVUE takes no platform fee and has no revenue, and an unfunded bounty attracts more work than it can triage and arguments it cannot settle. Credit is what we have, so we give it properly.

Advisories

We publish a write-up when a finding affected real user data or real money. We do not publish one for a finding that reached nobody — an advisory about a vulnerability with no victims is theatre, and it buries the ones that matter.

A machine-readable version of this page lives at /.well-known/security.txt, in the format RFC 9116 defines. Its contact field points at the form above rather than at an address — the standard permits a URL, and here that is the honest choice.

The file carries an expiry date, currently Dec 8, 2026. A reader is required to ignore the file once that date has passed, so the date is derived from a named constant in the source and a unit test fails a month before it arrives. Renewal is a task somebody is handed, not something that quietly stops working.

The same discipline the other documents here keep: what has not been settled is named, rather than left to look as though it were handled.

• Which legal entity stands behind the commitment at the top of this page. It is given by the operator of this platform, and the counsel review noted above has not happened yet.