How to report a problem
Email security@talkwish.com. You can write to us in English or French. Please tell us privately first, not through support, social media or a public forum, so we can fix the problem before anyone can misuse it.
Having trouble with your own account, such as a sign-in you don't recognize? Email support@talkwish.com instead, and see how to keep your account secure.
Our contact details are also in security.txt, the standard file security researchers look for.
What to include
A short, clear report is fine. It helps if you tell us:
- What the problem is and what someone could do with it
- The steps to reproduce it, and the web address, app and version where you found it
- Any proof of concept, screenshots or requests that show it
- The usernames of the test accounts you used
- How to reach you, and whether you'd like to be thanked by name on this page
What is in scope
- talkwish.com, this website
- app.talkwish.com, the Talkwish web app
- api.talkwish.com, the service behind our apps
- The Talkwish apps for iPhone, Android, Windows and Mac, as each one is released
These are out of scope:
- Services run by other companies that we use, such as our payment provider, Clover. Please report those to the company directly.
- Reports from automated scanners without a working example of the problem
- Missing best-practice settings that can't actually be used to cause harm
- Social engineering, phishing or physical attacks against our team or anyone else
Rules for testing
To keep Talkwish safe for everyone while you test:
- Use only accounts you own. Create your own test accounts, and never sign in to anyone else's.
- Don't access, change or delete other people's data. If you come across someone else's information by accident, stop, don't keep or share it, and tell us in your report.
- Don't run denial of service attacks, load tests or anything else that could slow down or break Talkwish for other people.
- Don't commit toll fraud, and don't place calls or send texts to phone numbers, including premium-rate numbers. Never call 911 or any other emergency number while testing. Calls and texts between your own test accounts are fine.
- Don't send spam or unwanted messages to other Talkwish users.
- Do only what you need to show the problem, and stop once you've confirmed it.
- Give us reasonable time to fix the problem before you share any details with anyone else, and agree on the timing with us.
Safe harbor
If you make a good-faith effort to follow this policy, we consider your research authorized. We won't take legal action against you or report you to law enforcement for it, and we won't treat it as a breach of our terms of service or acceptable use policy. If someone else takes legal action against you for research that followed this policy, we'll make it known that your research was authorized.
This only covers the Talkwish systems listed in scope. We can't give permission to test systems that belong to other companies. If you're not sure whether something is allowed, ask us at security@talkwish.com before you test.
After you report
- We'll let you know we got your report, usually within three business days.
- We'll look into it, tell you whether we can confirm the problem, and keep you updated while we work on a fix.
- We'll tell you when it's fixed and agree with you on when the details can be shared.
These are our goals, not guarantees. How long a fix takes depends on the problem, so we can't promise a set time.
No bug bounty
We don't run a bug bounty program, so we can't pay for reports. We're still very grateful for them, and with your permission we'll thank you by name below.
Thank you
We list people who reported a security problem that we confirmed and fixed, with their permission. There's no one on the list yet.