Security
Report vulnerabilities in good faith.
TraceSignal intends to protect search data through server-only credentials, encrypted reports, strict ownership checks, and minimized telemetry.
In scope
Authentication bypass, report access across accounts, secret exposure, query leakage, injection, unsafe uploads, and payment entitlement flaws.
Safe research
Use fictional data, avoid accessing other users’ reports, do not degrade service, and provide enough detail to reproduce the issue privately.
Disclosure channel
A verified security contact and response SLA must be configured before production launch.
Operator identity, jurisdiction, support address, and final legal review are launch blockers and must be configured before production.