Vulnerability Disclosure Policy

At TerminalStreet, security is a priority. We appreciate the security community's efforts to responsibly disclose vulnerabilities and we're committed to addressing security issues promptly.

Reporting a Vulnerability

If you believe you've found a security vulnerability in any TerminalStreet-owned repository, service, or application, we encourage you to let us know right away. We will investigate all legitimate reports and do our best to quickly address the issue.

Contact Information

Please report security vulnerabilities by emailing:

[email protected]

Guidelines

To help us address your report efficiently, please include the following information:

  • Description of the vulnerability
  • Steps to reproduce the issue
  • Potential impact of the vulnerability
  • Any suggestions for mitigation (optional)
  • Whether you'd like to be acknowledged publicly for your finding

Scope

This policy applies to all TerminalStreet-maintained repositories, services, applications, and websites.

In-Scope

  • terminalstreet.com and all subdomains
  • TerminalStreet applications and services
  • TerminalStreet's public APIs
  • Public repositories maintained by TerminalStreet

Out-of-Scope

  • Attacks that require physical access to a user's device
  • Social engineering attacks
  • Denial of service attacks
  • Issues that require extensive user interaction
  • Third-party services not directly under TerminalStreet's control

Responsible Disclosure

We request that you:

  • Make a good faith effort to avoid privacy violations, destruction of data, or interruption or degradation of our service
  • Only interact with accounts you own or have permission to interact with
  • Do not exploit a security issue you discover for any reason other than for testing purposes
  • Do not share information about the vulnerability with others until we've had a chance to address it

Our Commitment

When working with us according to this policy, we commit to:

  • Acknowledge receipt of your vulnerability report within 2 business days
  • Provide an estimated timeframe for addressing the vulnerability
  • Notify you when the vulnerability is fixed
  • Publicly acknowledge your responsible disclosure, if desired (unless you request to remain anonymous)

Safe Harbor

To encourage vulnerability research and responsible disclosure, we will not pursue civil or criminal action against you for security research conducted in accordance with this policy. We consider security research and vulnerability disclosure activities conducted consistent with this policy to be:

  • Authorized in accordance with computer crime laws
  • Exempt from the Digital Millennium Copyright Act (DMCA)
  • Exempt from restrictions in our Terms of Service that would otherwise prohibit you from conducting security research

Please note that if your security research involves the networks, systems, or data of another entity, that entity's policy may apply, and we cannot authorize actions that would violate that policy.

Thank You

We value the security community and believe that responsible disclosure of security vulnerabilities helps us ensure the security and privacy of all our users. Thank you for helping keep TerminalStreet and our users safe.

Last Updated: April 25, 2025