Security and vulnerability disclosure
Last updated 3 October 2026
In short: if you have found a security problem, emailsupport@tessule.com with enough detail to reproduce it. We will confirm we have it, tell you what we found, and fix it on the timescales below. We will not take legal action against research done under this policy.
How to report
Email support@tessule.com with what you did, what happened, and why it matters. Steps to reproduce, the affected URL and a proof of concept are worth more than a scanner's output. Tell us how you want to be credited, or that you would rather not be. The machine-readable version of this contact is athttps://tessule.com/.well-known/security.txt.
What is in scope
- The application at
app.tessule.com, its REST API and its MCP endpoint. - The OAuth authorisation server that backs AI-client connections.
- This public site and the documentation served under it.
- Anything that crosses the tenancy boundary — one workspace reaching another workspace's data — which we consider the most serious class of bug this product can have.
What is not
- Denial of service, volumetric or resource-exhaustion testing of any kind.
- Social engineering, phishing or physical attempts against anyone.
- Findings from automated scanners with no demonstrated impact, and missing hardening headers with no exploit path.
- Third-party services we use but do not run; report those to their owners.
What we ask
Use only accounts and workspaces you own or have been given permission to test. If you reach someone else's data, stop, do not save or share it, and tell us what you saw so we can assess the exposure. Do not alter or delete data that is not yours, and do not run tests that degrade the service for other people. Give us a reasonable chance to fix the issue before you publish; we are happy to coordinate a date with you.
What you can expect
These response targets are published commitments, not a contractual service level. They mirror the severity policy we hold our own findings to.
| Stage | Target |
|---|---|
| Acknowledgement that we have your report | 3 working days |
| Our assessment of severity, back to you | 5 working days |
| Fix or mitigation — critical | 7 days |
| Fix or mitigation — high | 30 days |
| Fix or mitigation — medium | 90 days |
| Low severity | Fixed as we touch the area; we will say so |
We will tell you when the fix ships. If we expect to miss a target, we will tell you and give a revised date.
Safe harbour
If you follow this policy, we will treat your research as authorised, will not pursue or support legal action against you over it, and will work with you if someone else does. This does not extend to accessing, keeping or sharing other people's data beyond what is needed to demonstrate the problem, nor to anything unlawful under the law of England and Wales.
Reward
We do not run a paid bug-bounty programme. We will credit you publicly if you want that, and we will always tell you what your report changed.
Related
How we handle your data is in the privacy policy; the terms of use are in the terms of service. General questions, as always: support@tessule.com.