Vulnerability Disclosure Policy

Effective date: October 4, 2026

In short: Report a security weakness to support@tonamorph.com. We authorise good-faith research within the scope and limits below and will not pursue a civil claim merely for compliant research. Use your own accounts and data, stop at proportionate proof, and do not disrupt the Service. We aim to acknowledge within three business days. This policy cannot authorise access to a supplier's systems or bind a public authority.

1. Purpose

This policy is offered by Tonamorph — that is, the operator identified in section 1.1 of the Terms of Service ("we", "us") — for researchers and anyone who discovers a weakness in Tonamorph. You may report without an account or a purchase, and without signing a separate NDA. A report alone is not permission to test systems outside the scope below.

2. Reporting

Email support@tonamorph.com. Describe the affected host, endpoint or release, reproducible steps, expected impact and the minimum evidence needed. Use identifiers for accounts and jobs you control. Do not send passwords, API keys, payment information, a database dump or other people's audio.

English, Hebrew or Russian reports are accepted. Provide a preferred credit name or request anonymity. For sensitive evidence, first request a secure channel without sending the sensitive details. A contact and policy link are published at https://tonamorph.com/.well-known/security.txt.

3. Scope

Authorised scope is our own website and application at https://tonamorph.com, our publicly documented API application endpoints, and released Tonamorph plugins and installers. It concerns our application logic, authentication integration, authorisation, local storage and delivery mechanisms to the extent we control and are entitled to authorise testing of them.

It does not authorise testing a cloud provider's platform, merchant checkout, identity service or unrelated tenant merely because our application uses it. It excludes denial of service, volume testing, social engineering, physical intrusion, credential theft and disruption of other users. A hostname suffix is not a blanket authorisation over every connected system. Ask before expanding a test into another system.

A finding's eligibility for remediation prioritisation is separate from the researcher's protection for complying with this policy. We do not automatically treat a low-severity or duplicate report as bad faith.

4. Research limits

Use your own accounts and audio, low-volume tests and reversible steps. Stop when a limited proof establishes the issue. Do not retain access, plant persistence, pivot, alter billing records for benefit or escalate beyond what the proof requires.

If you unexpectedly encounter another person's data, stop, avoid copying or downloading it and report the location with redacted evidence. Do not inspect further records to estimate the affected population. Do not include another person's data in public evidence.

Do not extort payment, threaten harm or withhold necessary remediation information in exchange for payment. Asking whether a voluntary reward is available is not itself extortion.

5. Authorisation and its limits

For research that follows this policy, we — the operator identified in section 1.1 of the Terms of Service — regard testing of our in-scope assets as authorised and will not bring a civil claim solely for that compliant research. The relevant anti-circumvention and reverse-engineering restrictions in our Terms and EULA do not prohibit that research to the extent we are entitled to give permission.

We do not request criminal enforcement solely because compliant good-faith research occurred. We may still comply with compulsory legal process, make legally required incident reports or report independently unlawful conduct. We cannot bind prosecutors, courts, other rights holders or infrastructure providers, or promise immunity under a law that our consent cannot displace.

If a third-party question arises, we can accurately confirm that research within this scope was authorised. We do not promise to pay a researcher's defence costs or guarantee another party's response. A later change to this policy does not retrospectively withdraw permission for work that complied with the then-published version.

6. Response, disclosure and attribution

Our operational targets are acknowledgement within three business days, an initial reproduction/severity assessment within ten business days, and a progress update at least every 14 days while substantive work remains open. These are targets, not a guaranteed repair deadline or a payment-bearing service level. Urgent incidents are triaged without waiting for these targets.

We ask you to coordinate disclosure. You may publish your own finding 90 days after reporting, or once we release the fix, whichever comes first, subject to law and the rights of others. We may request additional time with reasons, but do not claim an automatic indefinite embargo. Publication must not disclose other users' data, live credentials or confidential material belonging to a third party. Our permission cannot waive a separate supplier's rights.

With your consent, we credit you using the name you choose. You retain rights in your report and tools; we receive only the permission needed to investigate, fix and explain the issue. We do not require assignment of your independent research.

We do not currently promise a paid bug bounty. Any separately offered reward must be agreed in writing; the absence of payment does not remove the authorisation given here.

7. Possible personal-data incidents

We promptly assess whether a report establishes or suggests a personal-data breach, contain the issue and meet applicable notification duties. Under GDPR-type rules, the relevant trigger is awareness of a reportable breach, not automatically every vulnerability email and not necessarily completion of a full forensic investigation. A report can itself establish awareness if sufficiently informative. Other laws may prescribe different triggers and deadlines. We record receipt, assessment and awareness times and escalate suspected incidents promptly.

The ordinary acknowledgement target does not postpone statutory deadlines, including weekends where the applicable clock runs continuously. Our Privacy Policy describes incident handling. We do not ask a researcher to conceal an incident that the law requires to be reported.

8. Other requests

Copyright complaints follow the Copyright Policy. Personal-data requests go to privacy@tonamorph.com. Billing or product issues go to support@tonamorph.com under the Refund Policy. Do not send credentials through any of these channels.

9. Policy versions

The version in force for the relevant research governs the permission given for that research. Keep a copy; we retain earlier published versions. A revised scope applies prospectively and is not a promise that third-party assets were previously ours to authorise.

10. Contact

Tonamorph · Security: support@tonamorph.com · Legal: legal@tonamorph.com · https://tonamorph.com
Operator details: Terms of Service, section 1.1.