Security and responsible disclosure

Your clients trust you with their birth details, and you trust Trikona with them. If you find a security weakness in Trikona, please tell us so we can fix it quickly.

How to report

Email support@trikona.app with "Security" in the subject line. Please include:

• what you found and where (web address, app screen or API endpoint),
• steps we can follow to see it ourselves,
• what someone could do with it.

We will confirm we have your report within 3 business days and keep you updated until it is fixed.

Please do

• Test only with your own account, or test accounts you created.
• Stop as soon as you have shown the problem, and tell us.
• Give us reasonable time to fix it before you tell anyone else.

Please do not

• Open, change or delete anyone else's data, including client charts and notes. If you reach someone else's data by accident, stop, do not keep a copy, and tell us.
• Run tests that slow down or break the service, such as flooding, heavy automated scanning or spam.
• Trick, phish or pressure our team or our users.
• Ask for payment in exchange for the details.

Our promise to good-faith researchers

If you follow this policy, we treat your research as authorised. We will not take legal action against you for it, and we will work with you to understand and fix the issue.

Rewards

We do not pay cash rewards for reports. Once a fix is live, we are glad to thank you publicly if you would like that.

Not in scope

• Scanner output without a working example.
• Best-practice suggestions with no real impact on users.
• Problems inside the third-party services we use. Please report those to the provider, unless our setup causes the problem.

Machine-readable contact details are at /.well-known/security.txt.