Security disclosure policy

Last updated 2026-09-24.

Reporting an issue

Reach us at [email protected]. For sensitive details, encrypt to our OpenPGP key, fingerprint 4445 CF31 A1BA 2B49 F99E BEEA 314F C91A BE12 164C. We aim to acknowledge within 14 days and ship a fix or accept the finding within 90 days.

Scope

• api.tarnon.com · crowd.tarnon.com · safe.tarnon.com · pir.tarnon.com · ohttp.tarnon.com
• The TarnGuard apps for iOS and Android

Out of scope

• Social engineering against Tarnon staff
• Denial-of-service tests against production infrastructure

← Back to Tarnon