Report a security issue

If you found a vulnerability in this site or in one of our apps, email security@turboclientsystems.com. Turbo Client Systems reads that address and nothing else goes to it.

What to send

• The address or app and the steps to reproduce the issue.
• What you could reach or change, and what you did not.
• How to reach you. We reply by email only.

In scope

• This site, www.turboclientsystems.com, and its API routes.
• Our customer apps. They run in the customer's own tenant; report the flaw here and do not test against a customer's tenant.

Out of scope

• Denial of service, load testing and automated scanning at volume.
• Social engineering of our staff or customers, and physical attacks.
• Findings that need access to someone else's account or data.
• Reports with no demonstrated impact, such as a missing header on a static file.

What happens next

Our target is to acknowledge a report within 5 business days and to tell you what we decided within 15. These are targets, not commitments, and we have no bug bounty. We credit you publicly if you ask us to.

No licensed attorney has reviewed this policy, and it is not final until one has. The machine-readable version is at /.well-known/security.txt.