Vulnerability Disclosure Program

What is in scope

Please test only these:

• Our website at talismanleads.io and its subdomains, including the sign-in, account, billing and free tool pages.
• Our Telegram bot, @TalismanLeadsV1bot.
• The website's own APIs, when you reach them from your own account.

If you are not sure whether something is ours, ask us before you test it.

What is out of scope

Please do not send reports about:

• Services run by other companies, such as Telegram, Cloudflare, payment networks and the live chat widget. Please report those to their owners.
• Other customers' accounts and data.
• What our checkers and free tools are built to do, such as saying whether a number or email address has an account.
• Whether an email address or username is already registered with us, on the sign-up, sign-in or password reset pages.
• Missing or weak email records (SPF, DKIM, DMARC, BIMI), DNSSEC or CAA records, and look-alike domains.
• Missing security headers (CSP, HSTS, X-Frame-Options and the like), cookie flags, and SSL/TLS settings such as cipher choices, unless you show a working attack.
• Software names and version numbers, server banners, and public files such as robots.txt, the sitemap or security.txt.
• Keys that are meant to be public, such as the CAPTCHA, analytics and browser-client keys in a page's source.
• Self-XSS, clickjacking or CSRF on pages with no sensitive action, logout CSRF, open redirects with no further impact, tabnabbing, and text injection that runs no script.
• Rate limits on public pages and forms, including email or sign-up flooding, unless they let someone take over an account or spend money.
• Password rules, session length, and two-factor authentication being optional or absent.
• Attacks that need physical access, a rooted or jailbroken device, an out-of-date browser, or a victim who is already compromised.
• Phishing, social engineering and denial of service.
• Passwords and other data from breaches of other sites, unless they work on ours.
• Output from automated scanners or AI tools with no working proof, and best-practice advice with no security impact.
• Bugs with no security impact, and questions about your account or billing. Please use the contact page for those.

We may close reports about these without a reply.

How to test safely

• Use only accounts you created yourself, and only numbers and email addresses you own or have permission to use.
• Do not read, change or delete data that is not yours. If you reach someone else's data, stop, do not keep a copy, and tell us.
• Do not run denial-of-service tests, flood forms, send spam or slow the service down for others.
• Do not try to trick our staff or customers, and do not attempt physical attacks.
• If an issue gives you balance or paid services, use no more than you need to show it, and tell us so we can reverse it.
• Keep the issue private until it is fixed and we have agreed on disclosure.

What to include in your report

• What the issue is and what an attacker could do with it.
• The page, API route or bot command affected.
• The steps to reproduce it, with screenshots or a proof of concept.
• How to reach you, and the name you would like to be credited under, if any.

Please leave other people's personal data out of your report.

What you can expect from us

• We acknowledge in-scope reports within 5 working days.
• We check the issue and tell you whether we can reproduce it and what happens next.
• We keep you updated while we work on it, and tell you when it is fixed.
• If you would like, we credit you when we write about the fix.

Safe harbor

If you act in good faith and follow this policy, we consider your research authorized. We will not take legal action against you or report you to the authorities for it. If someone else takes action against you over it, we will make clear that you acted under this policy.

This covers only TalismanLeads's own systems. We cannot authorize testing of anyone else's. If you are unsure whether something is allowed, ask us first.

Public disclosure

Please give us reasonable time to fix an issue before you publish anything about it. We aim to resolve confirmed issues within 90 days, and we will agree a date with you. Some issues take longer, and we will tell you if yours does.

Rewards

This is a disclosure program, not a bug bounty, so we do not pay for reports. We are grateful for your help, and we are glad to credit you for it. Reports that ask for payment before sharing the details are closed without a reply.

We may also name you in our Hall of Fame once the issue is fixed, with what you found. We name you only with your permission, and you can ask us to remove your entry at any time.