Vulnerability Disclosure Policy

1. Our commitment

Taskstreamer takes the security of our platform seriously. We are a small company and we rely on the security community to help us find and fix issues we have missed. This policy explains how you can report a security vulnerability to us, what you can expect from us when you do, and the protections we offer to researchers who work with us in good faith.

We welcome reports from anyone. You do not need to be a professional security researcher. If you have noticed something that looks wrong, we want to hear from you.

2. Scope

2.1 In scope

This policy covers the following Taskstreamer properties:

• The Strategy Application at strategy.taskstreamer.com and any tenant custom domain.
• Blueprint, delivered via Jira Plugin which is distributed via direct links.
• The Conductor execution layer and its associated APIs.
• Public marketing and documentation websites operated by Taskstreamer.

2.2 Out of scope

The following are not covered. Reports focusing on these are unlikely to be treated as security issues:

• Denial of service attacks, volumetric testing, or any activity that degrades availability for other users.
• Social engineering of Taskstreamer employees, contractors, customers, or our hosting partner Cyso.
• Physical attacks on Taskstreamer or Cyso facilities.
• Automated scanner output without a demonstrated real world impact.
• Missing security headers that do not produce an exploitable issue.
• Rate limiting on non authenticated endpoints where no user impact can be demonstrated.
• Issues in third party services that are not under Taskstreamer's control. Please report those directly to the relevant provider.
• Clickjacking on pages without sensitive actions.
• Outdated library versions without a demonstrated exploit path.

3. How to report

Send your report to security@taskstreamer.com.

A useful report contains:

• A clear description of the issue.
• The affected URL, endpoint, or component.
• Steps to reproduce, including sample requests or payloads where relevant.
• The impact you observed or believe is possible.
• Any supporting material (screenshots, video, proof of concept code) that helps us understand the issue.
• Your preferred name for recognition, or a statement that you wish to remain anonymous.

4. What you can expect from us

We also commit to treating you with respect, engaging in good faith discussion of the technical details, and recognising your contribution publicly if you want that (see section 6).

5. Safe harbour

This safe harbour has limits. It does not apply to activity that exceeds the rules of engagement in section 7, nor to activity that violates Dutch or EU law independent of Taskstreamer's authorisation. If you are unsure whether something you want to test falls inside this policy, contact security@taskstreamer.com first and ask. We would rather have a conversation than learn about it afterwards.

6. Recognition

We maintain a public acknowledgements page at taskstreamer.com/security-acknowledgements. If your report leads to a fix and you would like public recognition, we will add your name (or a handle of your choice) together with the date and a short description of the class of issue. Reports that identified novel or high impact issues may receive a more detailed writeup, coordinated with you.

Taskstreamer does not currently run a paid bug bounty programme. We do sometimes send a thank you in the form of credit or other courtesy, and we always credit researchers in any security advisory we publish, unless they prefer to remain anonymous.

7. Rules of engagement

For your work to be covered by the safe harbour, please follow these rules:

• Use only accounts you own or accounts that Taskstreamer has explicitly provisioned for you for research.
• Do not access, download, modify, or delete data that does not belong to you or to a test account.
• If you discover that you have accidentally accessed another customer's data, stop immediately, do not retain the data, and report it to us right away.
• Do not use automated scanners at a rate that affects service for other users. If you want to run sustained automated testing, contact us first.
• Do not perform denial of service testing, volumetric testing, or any activity that degrades availability.
• Do not pivot from a found issue into lateral movement across our infrastructure or customer environments.
• Do not publicly disclose the issue before we have had a reasonable opportunity to fix it. Our default is coordinated disclosure within 90 days, earlier if a fix ships sooner.
• Give us the information we need to reproduce and fix the issue. Paid disclosure, ransoms, or threats are not compatible with this policy.

8. Legal

This policy is governed by Dutch law. Taskstreamer BV is established in the Netherlands. Nothing in this policy constitutes a waiver of Taskstreamer's rights under applicable law, and nothing requires you to waive yours.

We may update this policy. The current version is always available at taskstreamer.com/vulnerability-disclosure. Material changes will be dated and summarised in the version history at the bottom of this page.

9. Contact

Email: security@taskstreamer.com

10. Version history

---