Security & vulnerability disclosure

We write vulnerability-disclosure processes for clients, so we hold this page to the standard we sell. If you have found a weakness in anything we run, we want to hear about it — directly, and without you needing a lawyer first.

How to report

Email info@talltree.tech with whatever you have: what you found, where, how to reproduce it, and your view of the impact. A rough note today beats a polished one next month.

If the details are sensitive, encrypt to our PGP key — the public keys page shows how. The machine-readable summary of this policy lives at /.well-known/security.txt.

What you can expect

• Acknowledgement within two working days, from the engineer who will actually investigate — not a ticket queue.
• A plain-English assessment of the impact, and updates until it is resolved.
• No legal action for research conducted in good faith: stay within the scope below, do not access, alter or destroy data that is not yours beyond the minimum needed to demonstrate the issue, and give us reasonable time to fix before you publish.
• Credit, if you want it — named or anonymous, your call. We do not run a bug-bounty programme, so we cannot promise payment; we can promise a serious reading and a straight answer.

Scope

talltree.tech and its subdomains — including the form relay (mayo.talltree.tech) and the first-party analytics proxies — plus anything else we demonstrably operate.

Out of scope

• Volumetric attacks and denial of service of any kind, including resource-exhaustion testing.
• Social engineering or phishing of anyone connected to the company.
• Third-party platforms we merely use — Stripe checkout, Google Calendar booking, GitHub — which have their own disclosure routes.

Reports about those are still read; “out of scope” simply means the good-faith commitment above is ours to give only for systems that are ours.

Contact

Security reports: info@talltree.tech · PGP: /keys/pgp.asc

Software Systems Limited, 7 Bell Yard, London WC2A 2JR, United Kingdom · Company No. 14466340 (England & Wales).