Vulnerability Disclosure Policy

Scope

This policy covers Ticket Tool-operated production services at these domains:

• ticket-tool.app and www.ticket-tool.app
• dash.ticket-tool.app
• api.ticket-tool.app
• kb.ticket-tool.app

Staging systems, customer-owned Discord servers, customer custom domains, Discord, and other third-party services are out of scope. Please report issues in third-party products to their owners.

Testing guidelines

Limit testing to the in-scope services and to activity needed to confirm a vulnerability. Use accounts and data you control.

• Do not access, change, or delete another person's data.
• If you encounter data that is not yours, stop testing and report what happened without copying or sharing the data.
• Do not perform denial-of-service, spam, phishing, social engineering, or physical attacks.
• Do not test customer-controlled servers, custom domains, or third-party services on our behalf.

How to report

Email security@ticket-tool.app. Please include the affected service, a clear description of the issue, its potential impact, and steps to reproduce it. A concise proof of concept is helpful when it can be provided safely.

Do not include passwords, access tokens, private keys, or personal data in your report. If you need to share sensitive details, tell us in your initial email so we can arrange a suitable method.

What to expect

We aim to acknowledge reports within 48 hours and keep you updated as we investigate. We do not promise a particular fix timeline or offer rewards for reports. Please give us a reasonable opportunity to investigate and address a verified issue before sharing it publicly; we are happy to coordinate disclosure timing with you.

Out of scope

The following are not eligible for handling under this policy:

• Issues in the out-of-scope systems listed above
• Findings that require denial-of-service or disruptive testing
• Social engineering, phishing, physical attacks, or attacks requiring access to someone else's device or account
• Reports without a demonstrated security impact, such as version disclosure or general best-practice suggestions alone