SECURITY
Disclosure policy.
Report a vulnerability in the tcp.systems suite privately. We acknowledge every report, tell you what we find, and credit you in the release notes unless you ask us not to.
What to send
Send the affected surface, the exact request or step that reproduces it, the impact you observed, and any remediation you already tried. A minimum reproduction is worth more than a long description.
| security@tcp.systems | |
| Machine-readable | /.well-known/security.txt |
| Scope | All public tcp.systems surfaces and the gateway at ai.tcp.systems |
| Response target | 3 business days to first reply |
| Do not test | Third-party hosts, other tenants, denial of service, and social engineering |
Hardening you can verify
The apex serves a strict content security policy, denies framing, sends HSTS with subdomains, and pins its own permissions policy. The proof endpoint is public and unauthenticated because it reports only reachability, never secrets.