1Scope
This policy covers the TrustNet service and its first-party surfaces:
trustnet.app, me.trustnet.app,
id.trustnet.app, rp.trustnet.app, the
persona-api endpoints and the static legal pages. It does not cover the
independent relying parties that use TrustNet.
2How to report
Email privacy@trustnet.app with the subject “Security report”. Include:
- what you found and where;
- steps to reproduce, with a minimal proof of concept;
- the impact you believe it has;
- how we can contact you.
Do not include other people's personal data, tokens or claim values in the report. Do not test against accounts or data you do not own.
3What to expect
- We acknowledge a report within 3 business days.
- We give an initial assessment within 10 business days.
- We keep you informed of material progress and tell you when the issue is fixed.
- We credit reporters who want credit, once the fix is deployed.
4Safe harbour
If you act in good faith under this policy, do not access or alter other users' data, do not degrade the service, and give us reasonable time to fix the issue before publishing, we will not pursue legal action for the research itself. This does not waive any rights of third parties or permit unlawful activity.
5Out of scope
- Denial-of-service, brute-force or load testing.
- Social engineering of staff or users.
- Physical attacks or lost devices.
- Reports from automated scanners with no demonstrated impact.
- Issues in third-party relying parties or their infrastructure.
6Contact
Security contact: privacy@trustnet.app. The machine-readable policy is in /.well-known/security.txt.