Responsible Disclosure

Last updated: October 14, 2026

We want to hear about any security problem you find in TatFinder™. If you report it to us privately and give us a reasonable chance to fix it, we will work with you and credit you if you'd like.

What to include

• What you found and where (the URL, screen or API endpoint).
• Steps to reproduce it, and what an attacker could do with it.
• How to reach you for follow-up questions.

In scope

• tatfinder.com and www.tatfinder.com, including its /api/ endpoints.
• The TatFinder™ iOS app.
• Our backend endpoints that the site and app call.

Out of scope

• Denial-of-service, load or spam testing, including flooding our forms.
• Social engineering, phishing, or physical attacks on our team or artists.
• Problems in services we use (Stripe, Supabase, Google, Vercel, Cloudflare, Anthropic, Salesforce). Report those to the provider.
• Reports from automated scanners with no demonstrated impact, missing best-practice headers with no exploit, and clickjacking on pages with no sensitive action.

Please

• Use only your own accounts and test data. Don't access, change or delete anyone else's information. If you reach real user data by accident, stop, don't keep it, and tell us.
• Don't degrade the service for other people.
• Give us a reasonable time to fix the problem before you share it publicly.

What we'll do

• Confirm we received your report, and keep you updated while we work on it.
• Tell you when it's fixed, and credit you publicly if you want us to.
• Not take legal action against research done in good faith under this policy.

We don't run a paid bug bounty at this time.