Security reporting

Report a security issue

We welcome good-faith reports about ThreatWing-owned software and surfaces. Please send an initial report with enough detail to identify the affected product and issue.

Before reporting

• Do not access data belonging to another person, establish persistence, degrade service, or test third-party infrastructure.
• Stop after establishing the minimum evidence needed to explain the issue.
• Remove credentials, personal data, proprietary binaries, and working exploit payloads from the first message.
• Preserve the affected product, version, URL, timestamp, prerequisites, observed result, and expected result.

Contact

Email security@threatwing.com with the subject “ThreatWing Security,” and request a protected follow-up channel when sensitive evidence is necessary. Do not use public issue trackers.

Scope and response

We do not run a bug bounty and cannot promise a response time. This page does not authorize you to test any system; that requires a written agreement.

What we do on our side

The public site does not store product credentials or accept binaries. Decompiler access is handled separately from website browsing. See Privacy Policy for the data each product uses and security.txt for the reporting contact.