Responsible Disclosure Policy

Last updated: April 25, 2025

At TerminalStreet LLC ("TerminalStreet," "we," "us," or "our"), we take security seriously. We value the security community and believe that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of our users and their data.

1. Safe Harbor

TerminalStreet strongly supports security research and believes that working with skilled security researchers is crucial for maintaining robust security. To encourage responsible disclosure, we provide Safe Harbor for security vulnerability research that:

• Is conducted in accordance with this policy
• Is conducted only on the systems, services, and applications listed in the "Scope" section
• Does not violate any law or breach any data protection regulations
• Is reported directly and confidentially to TerminalStreet as described in this policy

Under this Safe Harbor:

• We will not initiate or recommend legal action against security researchers who conduct vulnerability research according to this policy
• We will not pursue or support any legal action related to research conducted under this policy by third parties
• Security researchers will be exempt from our regular Terms of Service prohibitions on unauthorized system access, as long as they adhere to this policy and act in good faith

Note: If legal action is initiated by a third party against a security researcher for activities conducted in accordance with this policy, we will make it clear to the third party that the researcher's activities were authorized and conducted in compliance with our policy.

2. Scope

2.1 In-Scope Systems and Services

This policy applies to the following TerminalStreet production systems, services, and applications:

• *.terminalstreet.com web applications and API endpoints
• TerminalStreet mobile applications (iOS and Android)
• TerminalStreet desktop applications (Windows, macOS, and Linux)
• Public-facing infrastructure supporting the above services

2.2 Out-of-Scope Systems

The following are explicitly OUT OF SCOPE for security testing:

• TerminalStreet's physical premises and infrastructure
• Third-party services and applications used by TerminalStreet but not developed by us
• Client infrastructure, systems, or applications (unless specifically authorized by both the client and TerminalStreet)
• Systems or services hosted by third-party providers that we use
• Social engineering attacks against TerminalStreet employees or contractors
• Any staging, testing, or development environments not explicitly listed as in-scope

Important: If you're unsure whether a specific target is in scope, please contact us first at[email protected] before proceeding with any testing.

2.3 Test Accounts

When testing our systems, please create and use test accounts with fictitious information unless specific functionality requires otherwise. If testing requires a paid account or feature, please contact us first, and we may provide a test account or credit.

Never attempt to access, modify, or test using other users' accounts or data without explicit permission.

3. Guidelines for Vulnerability Research

3.1 Authorized Testing Methods

When conducting vulnerability research on TerminalStreet systems:

• Make reasonable efforts to avoid privacy violations, destruction of data, disruption of services, and degradation of user experience
• Use only testing tools and techniques that are necessary to identify the vulnerability
• Only interact with your own accounts or test accounts you have created
• Do not exploit vulnerabilities to access, modify, delete, or exfiltrate data that is not your own
• Cease testing immediately if you discover a vulnerability that provides access to another user's account or non-public data
• Do not use discovered vulnerabilities for any purpose other than to report them to us
• Do not share access to TerminalStreet systems with others

3.2 Prohibited Activities

The following activities are explicitly prohibited and NOT protected by this policy:

• Denial of Service (DoS) attacks or testing that degrades systems or services
• Physical attacks on TerminalStreet facilities or infrastructure
• Social engineering attacks, including phishing, against TerminalStreet employees, contractors, or users
• Exploiting vulnerabilities to access, modify, or delete data belonging to other users
• Introducing malware or malicious code into TerminalStreet systems
• Testing of third-party applications, websites, or services that integrate with TerminalStreet (unless you have permission from both parties)
• Automated scanning using vulnerability scanners without prior authorization
• Using exploits to exfiltrate data beyond what is necessary to demonstrate the vulnerability
• Attempting to extort, blackmail, or intimidate TerminalStreet based on discovered vulnerabilities

4. Reporting a Vulnerability

4.1 Reporting Process

If you discover a security vulnerability in our systems, please:

1. Report the vulnerability to us as soon as possible by sending an email to [email protected] with the subject line "Security Vulnerability Report"
2. Encrypt sensitive information using our PGP key (available on our security page)
3. Do not disclose the vulnerability publicly or to any third parties before we have had a reasonable time to address it

4.2 Report Content

To help us understand and address the issue effectively, please include the following information in your report:

• A detailed description of the vulnerability and the potential impact
• The affected system(s), service(s), or application(s)
• Steps to reproduce the vulnerability (including any tools used)
• Proof of concept (if available and not destructive)
• Any supporting attachments (screenshots, videos, or logs)
• Your name and contact information (if you wish to be credited)
• Whether you want public recognition for your discovery (see "Recognition" section)

4.3 Our Response Process

When you report a vulnerability, you can expect the following from us:

1. Acknowledgment of your report within 2 business days
2. Initial assessment of the vulnerability within 5 business days
3. Regular updates about our progress if the resolution takes time
4. Notification when the vulnerability has been resolved
5. Recognition for your contribution, if desired (see "Recognition" section)

We prioritize vulnerabilities based on their severity, exploitability, and potential impact on our users and systems.

5. Vulnerability Classification

We classify vulnerabilities based on the Common Vulnerability Scoring System (CVSS v3.1) and prioritize them as follows:

• Critical (CVSS 9.0-10.0): Vulnerabilities that could be exploited to gain system or administrative access, expose significant amounts of sensitive data, or allow execution of arbitrary code without user interaction.
• High (CVSS 7.0-8.9): Vulnerabilities that require user interaction but could still lead to significant data exposure, account takeover, or compromise of system integrity.
• Medium (CVSS 4.0-6.9): Vulnerabilities that have limited impact or require significant user interaction or specific conditions to exploit.
• Low (CVSS 0.1-3.9): Vulnerabilities with minimal risk or require extraordinary circumstances to exploit.

Response times and remediation priorities are based on this classification system.

6. Recognition and Rewards

6.1 Public Recognition

If you would like to be publicly recognized for your contribution:

• We will include your name (with your permission) in our security acknowledgments page
• We may provide a letter or certificate of recognition upon request
• We may acknowledge your contribution in security advisories related to the vulnerability

If you prefer to remain anonymous, we will respect your privacy and not disclose your identity.

6.2 Rewards

While we don't currently operate a formal bug bounty program with monetary rewards, we may offer:

• TerminalStreet account credits or service subscriptions
• Promotional items or merchandise
• Letters of recommendation or acknowledgment for career development
• For exceptionally serious vulnerabilities, we may consider discretionary rewards

7. Disclosure Policy

7.1 Coordinated Disclosure

We follow a coordinated disclosure process:

• We request that researchers keep vulnerabilities confidential until we have had a reasonable time to address them
• We aim to resolve critical and high-severity vulnerabilities within 90 days of receipt
• Once a vulnerability is fixed, we may publish a security advisory with technical details (with your permission if you are to be credited)
• We will notify affected users in accordance with our privacy policy and applicable regulations

7.2 Public Disclosure Timing

We request that security researchers:

• Allow us at least 90 days to investigate and address the vulnerability before any public disclosure
• Coordinate with us on the timing and content of any public disclosure
• Provide us with a draft of any planned public disclosure at least 1 week before publication

We recognize that security researchers may want to publish their findings after vulnerabilities have been fixed. We support this as long as it's done responsibly and doesn't include sensitive information about our systems or users.

8. Legal Considerations

8.1 Authorization

This policy provides limited authorization for security testing of the in-scope systems as defined above and in accordance with the guidelines provided. This authorization is:

• Limited to the activities specifically described in this policy
• Subject to the restrictions and prohibitions outlined in this policy
• Not transferable to any other individual or entity
• Subject to modification or revocation at any time

8.2 Legal Limitations

Please note that while we have established this policy with the intention of providing Safe Harbor for good-faith security research:

• This policy cannot provide protection against actions by third parties or law enforcement
• This policy does not override any applicable national, state, or local laws
• We cannot guarantee protection for activities that violate the law, regardless of this policy

If legal action is initiated by a third party against you for activities conducted in accordance with this policy, we will make it clear to the third party that your activities were authorized and conducted in accordance with this policy.

9. Specific Technology Considerations

9.1 AI and Machine Learning Services

For TerminalStreet's AI and machine learning services, special considerations apply:

• Testing for prompt injection, model extraction, or other AI-specific vulnerabilities is permitted, but must be conducted responsibly without massive data extraction
• When testing AI systems, avoid uploads of sensitive or illegal content even as test cases
• For testing AI model evasion, please use fictional or sanitized examples rather than actual harmful content
• Report any unintended behavior of AI systems that could pose safety risks

9.2 Blockchain and Crypto Services

For TerminalStreet's blockchain and cryptocurrency services:

• Smart contract auditing is permitted only on testnet environments, never on mainnet deployments
• Never attempt to exploit vulnerabilities that could result in actual financial loss
• Testing should use test tokens or assets, never real cryptocurrency
• Report any economic or cryptographic vulnerabilities immediately

9.3 Financial Technology Services

For TerminalStreet's financial technology services:

• Never conduct tests that could impact actual financial transactions or customer accounts
• Use only test accounts and test data provided by TerminalStreet
• Be particularly cautious with API testing that involves financial endpoints
• Immediately report any vulnerabilities that could lead to financial loss or regulatory compliance issues

10. Changes to this Policy

We may update this Responsible Disclosure Policy from time to time. We will notify researchers of significant changes by posting the updated policy on our website with a revised date.

Research conducted under a previous version of this policy will be governed by the policy in effect at the time the research began.

11. Contact Information

For all security-related communications, please contact:

[email protected]