Responsible Disclosure Policy

1. How to report

If you believe you have found a security vulnerability, please report it to us privately as soon as possible. Do not disclose it publicly, to third parties, or to other users until we have had a reasonable opportunity to investigate and remediate.

• Email security reports to [email protected] with “Security — Responsible Disclosure” in the subject line, or to [email protected] for technical reports.
• Send from an address we can reply to, so we can coordinate with you.
• If a report contains sensitive details, let us know and we will arrange a secure channel.

2. What to include

To help us validate and fix the issue quickly, please include as much of the following as you can:

1. A clear description of the vulnerability and its potential impact.
2. The affected domain, URL, endpoint or feature.
3. Step-by-step instructions to reproduce the issue, including any required accounts or configuration.
4. Proof-of-concept code, requests or screenshots where relevant.
5. Your assessment of severity and any suggested remediation, if you have one.

3. Safe harbour

We will not pursue legal action against, or report to law enforcement, security researchers who discover and report vulnerabilities in good faith and in accordance with this policy. We consider such activity authorised and will work with you to understand and resolve the issue quickly.

To qualify for safe harbour, you must act in good faith, avoid privacy violations and service disruption, only interact with accounts you own or have explicit permission to test, and not exploit the vulnerability beyond the minimum necessary to demonstrate it.

4. Rules of engagement

When researching, please respect our users and infrastructure. The following are required:

• Do not access, modify, delete or exfiltrate data that does not belong to you.
• Do not degrade, disrupt or overload the Services; no denial-of-service, automated high-volume scanning, or load testing.
• Do not use social engineering, phishing, or physical attacks against our staff, users or facilities.
• Do not send spam or test messages through the platform as part of your research.
• Stop testing and notify us immediately if you encounter personal data, and do not retain copies.

5. Out of scope

The following are generally considered out of scope and are usually not eligible reports, unless you can demonstrate a concrete, exploitable security impact:

• Reports from automated scanners without a demonstrated, exploitable impact.
• Missing security headers, cookie flags or best-practice suggestions with no direct exploit.
• Self-XSS that cannot be used against another user.
• Rate-limiting, brute-force or account-enumeration concerns without meaningful impact.
• Vulnerabilities in third-party services, libraries or integrations that we do not control (please report these to the relevant vendor).
• Social-engineering, phishing or physical-security issues.
• Spam, email-spoofing or deliverability concerns that do not stem from a vulnerability in our systems.

6. Our response commitment

When you submit a report that follows this policy, we commit to:

1. Acknowledge receipt of your report, typically within five (5) business days.
2. Validate the issue and keep you reasonably informed of our progress.
3. Work to remediate confirmed vulnerabilities in a timeframe appropriate to their severity.
4. Let you know when the issue has been resolved.

We ask that you give us a reasonable period to remediate before any public disclosure, and that you coordinate the timing of any disclosure with us.

7. Recognition

Tcom Mail does not currently operate a paid bug-bounty programme. We are, however, grateful for responsible reports and are happy to acknowledge researchers who help us improve the security of the Services, with their permission. If you would like to be credited, let us know in your report.

8. Contact

To report a security issue, email [email protected] or [email protected]. For non-security questions about this policy, you can also reach us during our support hours, Monday to Friday, 9:00–17:00 (GMT+1). Thank you for helping keep Tcom Mail and its users safe.