Report weaknesses without creating more harm.
This page explains how TACIB approaches vulnerability reports and where researchers should start when reporting a possible weakness in a third-party service.
Stop at the minimum evidence.
If you discover a possible vulnerability in a system you do not own, stop testing unless the owner has expressly authorized it. Do not access, alter, download, or disclose other people's data.
Look for the organization's own security contact or vulnerability disclosure policy. Follow its stated scope and reporting instructions. Do not assume that a system is in scope because it is publicly accessible.
For a TACIB-managed site issue, use the contact address only after verifying that it is valid. TACIB may not operate a formal bug bounty or provide a reward.
Prepare a responsible report ↗A useful report is specific and safe.
Share enough context to understand the risk without expanding exposure or sending confidential data unnecessarily.
Identification
Affected domain or product, the date observed, and affected component/version if known.
Impact
Explain the plausible security impact and the conditions required, separating facts from assumptions.
Minimal reproduction
Provide benign steps or a sanitized proof of concept that does not expose real user data or disrupt service.
Contact & disclosure
Give a safe reply method and allow the affected owner reasonable time to assess and remediate before public disclosure.
Scope and expectations
This page is a general statement of principles, not a promise of a coordinated disclosure service, response-time SLA, bug bounty, legal protection, or reward. For a third-party system, the system owner's policy controls. TACIB may be unable to validate or respond to every report.