1. Reporting a Vulnerability
At TellBack, data security is central to how we build. If you discover a security vulnerability in our platform, API, or widget, we encourage you to report it to us responsibly.
How to File a Report:
Please email your findings directly to security@tellback.io (with fallback to hello@tellback.io).
Please include the following details:
- Descriptive title summarizing the vulnerability.
- Affected components, URL pathways, or script inputs.
- Step-by-step instructions to reproduce the issue.
- Proof of Concept (PoC) scripts, logs, or viewport screenshots.
- Your contact details for coordination.
2. Safe Harbor & Good-Faith Scope
If you conduct security research in good faith, comply with these guidelines, and do not cause harm or access unauthorized customer data, we promise to work with you constructively and will not pursue legal actions.
| Scope Area | Testing Guidelines |
|---|---|
| Public Marketing | Marketing web pages (https://tellback.io) are fully in scope. |
| User Account | Your own registered accounts, workspaces, and whitelisted test sites. |
| Widget Script | Integration script (widget.js) loaded on your own configured test origins. |
3. Prohibited Testing Activities
The following research actions are strictly prohibited and fall outside safe harbor protections:
- Accessing, modifying, downloading, or deleting data belonging to another user, account, or workspace.
- Performing Denial of Service (DoS) or Distributed Denial of Service (DDoS) load tests.
- Social engineering, phishing, or spam attacks directed at TellBack users, employees, or contractors.
- Uploading malware, Trojan scripts, or executing destructive automated payload scans.
- Maintaining unauthorized persistent access or backdoors on our cloud servers.
4. Handling Timeline & Bug Bounty Status
We review reports and aim to acknowledge receipt within 3 to 5 business days. We will keep you updated as our team validates and resolves the reported vulnerability.
Bug Bounty Status: TellBack does not currently operate a paid bug bounty program. We offer security attribution and sincere thanks to researchers who help secure the community.
5. Core Platform Security Practices
We enforce several layers of defense-in-depth across our cloud architecture:
- Gated Firestore Access: Firebase Security Rules block clients from writing billing parameters, subscription flags, task status modifiers, and the
cancelAtfields directly. - Short-lived Storage Tokens: Direct public bucket reads are blocked. Uploads and diagnostic images are accessed through short-lived signed URLs expiring in 15 minutes.
- Private AI Boundaries: Clicks, screenshots, and logs are processed privately on Vertex AI Gemini enterprise APIs. Models never retain data or train public datasets on your logs.
- Auto-Pruning cleanup: Interactive events are pruned automatically after 7 to 30 days depending on plan, minimizing residual storage footprints.