Responsible Disclosure

We welcome reports from security researchers. If you believe you have found a vulnerability in TrueEngage, email security@true-engage.com and do not share it publicly until we have fixed it.

In scope

• true-engage.com and its subdomains, including the console and API
• The TrueEngage web, Android, iOS and Flutter SDKs

Out of scope

• Third-party services we use, such as our cloud provider, and Channel Providers connected by customers
• Customers’ own apps and websites that embed our SDKs
• Denial-of-service and volumetric testing
• Social engineering, phishing or physical attacks against our staff, offices or customers
• Findings without demonstrated security impact, such as missing headers on static pages, self-XSS, clickjacking on pages with no sensitive actions, banner or version disclosure, or rate limits on non-sensitive endpoints

• Test only against accounts and workspaces you created yourself. Use the Test environment where possible.
• Do not access, change or delete data that is not yours. If you reach other people’s data, stop, keep no copy, and tell us what you saw.
• Do not degrade the Services or send messages to real people.
• Use automated tools only at low request rates.
• Give us reasonable time to fix the issue before any disclosure.

Describe the issue and its impact, the affected URL, endpoint or SDK version, steps to reproduce, and any proof-of-concept. Do not include other people’s personal data. Tell us how you would like to be credited.

• Acknowledge your report within 2 business days.
• Confirm whether it is valid, and its severity, within 7 business days.
• Keep you informed while we fix it, aiming to resolve critical issues within 7 days and others in line with their severity.
• With your permission, credit you on this page once the fix is released, and agree with you when you may publish details.

We do not currently run a paid bug bounty.

If you act in good faith and follow this policy, we will treat your research as authorised, will not initiate legal action or complaints against you under the Information Technology Act, 2000 or otherwise in respect of it, and will make this commitment known if a third party acts against you. We cannot authorise testing of systems we do not own. Where the law requires us to report an incident to CERT-In or another authority, we will do so, and will describe your role as that of a good-faith reporter.