We welcome reports of security vulnerabilities and commit to working with researchers in good faith under a coordinated-disclosure model. Our posture is authorized-only and ANCS-aligned: we ask researchers to hold to the same standard we hold ourselves to on every engagement.
Last updated: 29 June 2026
Report security issues to security@tunicyberlabs.com. Include enough detail and clear steps to reproduce so we can validate the issue quickly. If a finding is sensitive, ask us and we will arrange an encrypted channel before you share details.
We operate coordinated disclosure, defaulting to private. We will acknowledge your report, keep you updated on our progress, and agree a disclosure timeline with you. Please give us a reasonable opportunity to investigate and remediate before any public disclosure.
Authorized-only is the foundation of how we work, and we ask the same of you:
For good-faith research that follows this policy, we will not pursue legal action and will treat you as a partner in keeping systems safe. We are happy to credit researchers who report valid issues, where they wish to be named.
Our disclosure practice is consistent with our broader authorized-only, ANCS-aligned framing. We will, where appropriate and lawful, coordinate with the relevant national authorities and affected parties to ensure issues are handled responsibly.
