Security and responsible disclosure

In short

Report issues to us before you publish them. We aim to acknowledge every valid report.

• Email abuse@tidalux.io with enough detail for us to reproduce the issue.
• In scope: tidalux.io and the products we run for customers.
• Out of scope: denial of service, social engineering, physical access, and third-party services we do not control.

How to report

We do not publish a separate security-only inbox. Email abuse@tidalux.io with the subject “Security report”. That address is monitored for abuse and security issues.

Please include:

• A clear description of the issue and the impact you believe it has.
• Steps to reproduce it, ideally with screenshots or a short recording.
• The URL or product affected.
• Your contact details so we can ask follow-up questions.

Do not post vulnerabilities publicly, on social media, or in a bug bounty marketplace before we have had a reasonable chance to fix them. We aim to acknowledge reports within five working days.

In scope

• tidalux.io and subdomains we operate for the company site, portal and billing.
• Wave products we host for customers (WaveSites, WaveAI, WaveCheck, and related services on our infrastructure).
• The App Studio at tidalux.ch and our published apps where we control the server-side code.
• Authentication, authorisation, and data handling bugs that could expose another customer’s data.

Out of scope

• Denial-of-service or load tests against production.
• Social engineering of our staff or customers.
• Physical access attempts to premises or hardware we do not own.
• Issues in third-party services (payment pages, app stores, email providers, analytics) except where our integration clearly worsens the risk.
• Reports that require a user to install untrusted software or disable their own security controls.
• Spam, missing security headers on static assets with no demonstrated impact, or theoretical issues without a practical exploit path.

Safe harbour

If you act in good faith, follow this policy, avoid privacy violations and service disruption, and give us reasonable time to investigate and fix an issue, we will not pursue legal action against you for that research. Safe harbour does not apply if you exfiltrate personal data, modify or destroy customer content, or extort us.

Our promise

• We aim to acknowledge your report within five working days.
• We will investigate in confidence and tell you when we have enough to reproduce the issue.
• We will fix confirmed issues as promptly as our resources allow and tell you when a fix is live, where it is safe to do so.
• We may credit you on this page or in release notes if you ask and if the fix is public, but we do not run a paid bug bounty programme.

security.txt

Machine-readable contact details for security tools are at https://tidalux.io/.well-known/security.txt (RFC 9116).