Vulnerability Disclosure

Reporting

If you believe you have discovered a security vulnerability in a Trooth product, service, or infrastructure, please report it to security@trooth.co. A PGP key fingerprint is available on request. We acknowledge every report within three business days and respond substantively within ten business days, with our assessment and an expected remediation timeline.

Trooth does not currently operate a paid bug bounty program and is not listed on HackerOne or Bugcrowd. Direct reports to security@trooth.co are welcomed, acknowledged within three business days, and credited if you wish.

Safe Harbor

Trooth will not pursue civil or criminal action against security researchers who in good faith comply with this policy. Specifically, researchers acting in good faith are permitted to:

• Test for vulnerabilities on systems and accounts you own or have explicit permission to test.
• Use a limited number of accounts strictly for testing.
• Avoid privacy violations, destruction of data, and interruption or degradation of the Services.
• Notify Trooth as soon as you discover a real or potential vulnerability.
• Stop testing and report the issue immediately if you encounter user data.

In Scope

• trooth.co, including the signed-in workspace and the public company pages
• api.trooth.co, the public API at its published endpoint
• badge.js, the badge loader script served from trooth.co, and the badge it renders

Out of Scope

• Social engineering of Trooth employees or contractors
• Physical attacks on Trooth facilities
• Denial of service attacks, including volumetric attacks
• Third-party services used by Trooth (report to the third party)
• Already known issues for which Trooth has published a mitigation

Reward Program

Trooth does not currently operate a paid bug bounty program and is not listed on HackerOne or Bugcrowd. We welcome direct reports to security@trooth.co, acknowledge them within three business days, and credit reporters who wish to be named. If a paid program launches in the future, its reward structure will be published on the security page.

PGP Key

Available on request to security@trooth.co.

Revised September 4, 2026: the scope no longer names mobile applications or SDKs, because Trooth publishes neither. It names what exists: trooth.co, api.trooth.co, badge.js and the public API. No safe-harbor commitment was narrowed.

Revision note. Revised September 23, 2026. This document said a vulnerability report is acknowledged within one business day, while the published Vulnerability Disclosure Policy commits to three business days and a substantive response within ten. This document now states the same three and ten business days. That lengthens the acknowledgment time this document stated, and the change is recorded here for that reason. The sentence saying Trooth rotates PGP keys on a published schedule was removed, because no schedule is published, and the missing period after the reporting address was restored. No safe-harbor commitment was narrowed, and the correction is recorded under our publication and correction policy.