Security Disclosure Policy
Last updated: November 3, 2026 · Machine-readable contact: security.txt
We build enforcement and attestation systems; we hold our own surface to the same standard. If you believe you have found a security vulnerability affecting Triple Optic Systems, we want to hear from you — and we will treat a good-faith report as help, not hostility.
How to report
Email [email protected] with a description of the issue, the affected system or page, and steps to reproduce. We aim to acknowledge reports within three business days and to keep you updated as we investigate. Please do not disclose the issue publicly until we have had a reasonable opportunity to address it; we will coordinate timing with you.
Scope
- In scope: tripleopticsystems.com and tripleopticsystems.global, and services we operate under those domains.
- Out of scope: third-party platforms and providers (report those to their operators), denial-of-service testing, and social engineering of any person.
Safe harbor
We will not pursue legal action against researchers who, in good faith:
- make a genuine effort to avoid privacy violations, data destruction, and service disruption;
- interact only with systems in scope and accounts they own or are permitted to test;
- stop, and report promptly, if they encounter another person's data; and
- follow the reporting and coordinated-disclosure terms above.
Good-faith research conducted under this policy is authorized as far as we are able to authorize it.
What we ask in a report
Enough detail to reproduce: affected URL or component, the class of issue, and a minimal proof of concept. Speculation is welcome if labeled as such — we would rather receive an early, partial report than a late, perfect one.