Reporting a security problem

Email support@tanzahost.com, and start the subject with Security. A person reads every report; nobody else sees it.

Please tell us:

• what you found, and where: the address, page or part of the dashboard;
• the steps to see it again, as short as you can make them;
• what someone could do with it;
• your name or the name you go by, if you'd like to be thanked.

If you saw another customer's data, tell us what kind it was, not the data itself, and delete any copy you made.

• A person replies within 3 working days, to say we have your report and whether we can see the problem.
• We fix a serious problem within 30 days, and others within 90 days, and keep you told along the way.
• We tell you when it's fixed, and thank you by name in the changelog if you want us to.
• If customers' data was reached, we tell them and the authorities as the law requires, and say what we changed.

Test only with accounts, projects and sites that are yours. Make as many test accounts as you need.

Stop as soon as you reach anything that isn't yours, and tell us what you did up to that point.

• slow down or stop our service or anyone's site, for example by flooding it with requests or filling a server;
• look at, change or delete other customers' data, beyond the least you need to show the problem;
• trick our staff or our customers, send spam or fake emails, or try to get into the buildings where our servers are;
• run tools that send thousands of requests, or test on the sites our customers run;
• tell anyone else about the problem before it's fixed, or before 90 days have passed since your report, whichever comes first, unless we agree otherwise.

If you follow this page in good faith, we won't take legal action against you or ask anyone else to, and we count your testing as allowed under our acceptable use policy.

If someone else takes action against you for testing that followed this page, we'll say that you had our permission.

We don't pay for reports yet. When we start, this page will say how much and for what.

A weakness in a customer's own site or code is theirs to fix: please tell them. If a site we host sends spam, cheats people or spreads harmful files, report it from the contact page instead.