TAS Group LLC, operator of TasScan, welcomes reports from security researchers who find vulnerabilities in TasScan's own systems. This policy explains what you may test, how to report, and what you can expect from us.
1. Scope
In scope are systems that TAS Group LLC owns and operates for TasScan:
- the public website at
tasscan.com; - the customer portal, administrator portal (the login and any publicly reachable parts of it) and the TasScan APIs under
tasscan.comhostnames that we operate; - the TasScan scanner and monitoring behavior, for example a way to make the scanner contact a target you do not own or that is not verified, or to bypass authorization, verification or network-safety controls;
- the TasScan mobile application; and
- container images and software we publish.
Out of scope:
- customer systems, customer assets, and any system that is not owned by TAS Group LLC (see section 4);
- third-party services we use (for example hosting, content delivery, email, payment and push providers); report those to the provider;
- other products and websites operated by TAS Group LLC or its affiliates that are not TasScan;
- denial-of-service, volumetric and stress testing;
- findings that come only from automated tools without a demonstrated impact, and best-practice observations without a security impact (for example missing headers on static pages with no exploit);
- physical attacks, and attacks on staff or premises.
2. Rules for researchers
You must not:
- cause a denial of service or degrade the service for others;
- use phishing or social engineering, or target our employees, contractors or customers;
- attack customers, or access, modify, delete or disclose customer data;
- attack unrelated third parties;
- use credential stuffing, password spraying or brute force against real accounts;
- perform destructive testing, or deploy malware;
- install backdoors or maintain persistence;
- pivot into other systems or access more than is needed to show the issue.
You must use only your own accounts and test data. If you encounter another person's data, stop, do not retain or share it, and tell us.
3. What we ask you to do
- Minimize impact. Use the least intrusive method that proves the issue.
- Stop after sufficient proof. Once you have shown that a vulnerability exists, stop. Do not escalate.
- Avoid unnecessary data access. Do not view, copy or keep data beyond the minimum needed for a proof of concept.
- Protect your evidence. Keep your report and proof of concept confidential and stored securely, and delete any customer or personal data you may have encountered.
- Notify TasScan promptly through the channel in section 5.
4. Authority limits: customer systems are not in scope
TAS Group LLC can authorize testing only against systems it owns or controls. Customer systems and assets are not automatically in scope, even if they appear in TasScan, and we cannot give you permission to test them. A customer's use of TasScan does not authorize you to test that customer. Testing a third party's system requires that third party's permission.
5. How to report
Use the contact details in our security.txt file, which lists the current security contact, policy location and expiry. If you cannot use those, use the official contact page and mark the message as a security report. Please do not post details publicly or include them in support tickets.
Include: a description and impact; the affected URL, host or component; reproducible steps or a proof of concept; the time and source IP of your testing; and how we can reach you. If you want to encrypt your report, say so in your first message and we will arrange a secure method.
6. What you can expect
- We will acknowledge your report within three business days.
- We will investigate, keep you informed of progress, and tell you when the issue is resolved.
- We will agree a disclosure timeline with you.
7. Coordinated disclosure
We follow coordinated disclosure. Please give us a reasonable time to fix an issue before you disclose it. A typical remediation window is up to 90 days from the report, depending on severity and complexity; we may need longer for complex issues and will tell you why, and we may fix critical issues much faster. If an issue is being actively exploited we may ask you to act more quickly. We will not stop you from publishing after the agreed period or the fix, but please share a draft in advance and avoid including customer or personal data. We will credit you on request once the issue is fixed.
8. Safe harbor
If you make a good-faith effort to follow this policy and your research stays within scope, we will treat your research as authorized under this policy. We will not initiate legal action against you for that research, and if a third party brings a claim against you for activity that complies with this policy, we will say that your research was authorized by us. This safe harbor covers only systems that TAS Group LLC has authority over and does not apply to research that breaks the rules in section 2, that goes outside scope, or that is carried out in bad faith. It does not bind third parties, who may take their own action, and it is not a waiver of any law that cannot be waived.
9. Rewards
There is no automatic entitlement to payment or reward for a report. We may offer thanks or acknowledgment. Rewards are paid only if a separate bug bounty program is announced and you meet its terms.
10. No extortion
Do not demand payment, benefits or other consideration in exchange for not disclosing or for deleting a vulnerability, or threaten to disclose, sell or misuse one. Such conduct is outside this policy, is not protected by the safe harbor, and may be reported to the authorities.
11. Changes
We may update this policy by posting a new version and effective date.