Found a security flaw? We would rather hear it from you.
Write to us through this form. There is no address to copy: your report reaches the Trupeo team, labeled as a security report. You can write in English or French.
Your report
Every field is required except your organization.
It goes out labeled: A security vulnerability.
Report sent.
Thank you. We'll acknowledge it at within 5 working days.
What happens next.
ALK Innovations, the company behind Trupeo, is a small team. Here is what you can expect from it.
- Within 5 working days
We acknowledge it
We acknowledge every report within 5 working days. That acknowledgement may be the only message you get until the issue is resolved.
- Once decided
We keep you informed
We will tell you when it is fixed, and if we decide not to fix it, we will tell you why.
- No news
Send it again
If you have not heard from us within 10 working days, assume your report did not arrive and send it again.
We do not currently run a paid bug bounty.
The scope.
What is in scope
- app.trupeo.com: the application, and its API under /api/.
- trupeo.com and www.trupeo.com: this website.
- The workers that fetch and file the emails of the mailboxes, insofar as you can reach them through the product.
What is out of scope
We close these reports without a fix:
- Findings from an automated scanner with no demonstrated impact.
- Missing hardening headers on endpoints that serve no credentialed content.
- Denial of service through volume, getting around rate limits by using many source addresses, or anything that requires physical access to someone's device.
- Social engineering of ALK Innovations staff or of the people who use Trupeo.
- Vulnerabilities in a third party Trupeo depends on: report those to that third party, and tell us too if Trupeo's configuration makes them exploitable.
- Anything that requires someone to have already installed malware or handed over their password.
Rules for security testing
What we ask in return for the commitment written above, under Before you send.
See the commitment again- Test against accounts you own. Anyone can create a Trupeo account at app.trupeo.com, with a 30-day free trial and no card. So there is no need to touch anyone else's data, and a report that does is no longer made in good faith or in scope.
- Do not run load or stress tests, and do not change or delete data you did not create.
- If showing the flaw would mean reading someone else's mailbox, stop at the point where you have shown you could, and tell us that instead.