Vulnerability disclosure policy
Last updated:
TrueProxies, LLC, a Delaware limited liability company (file number 10766986), operated by John Hale, runs trueproxies.com and the TrueProxies services. If you find a security vulnerability in them, we want to hear about it. This policy explains how to report it, what you may test, and how we treat good-faith research.
How to report
Email hello@trueproxies.com with "Security" in the subject. Please include:
- The affected URL, hostname or API endpoint
- Steps to reproduce the issue
- What an attacker could do with it
- Your name or handle, if you would like to be credited
Do not include another person's data in your report. A description of what you could reach is enough.
In scope
- trueproxies.com and the subdomains we run, including the dashboard, docs, API, sign-in pages and MCP server
- Our proxy gateways, tested with your own account only
Out of scope
- Denial of service, load testing or anything that degrades the Services for others
- Social engineering or phishing of our staff or customers
- Physical attacks on offices, data centers or equipment
- Accounts, data or traffic that belong to anyone else
- Third-party services we use, such as payment, chat, email, hosting and CDN providers; report those to the provider
- Residential IP addresses and networks supplied by our upstream partners
- Using our proxies to test or attack websites that are not ours; the Acceptable Use Policy still applies
- Spam, and reports from automated scanners that do not show a real impact
Rules for testing
- Use only accounts you own.
- If you reach data that is not yours, stop, do not keep or share it, and tell us.
- Do only what is needed to show the issue.
- Do not share details publicly until we have fixed the issue or 90 days have passed since your report, whichever comes first.
Safe harbor
If you follow this policy, we consider your research authorized. We will not take legal action against you or report you to law enforcement for it. To the extent needed for that research, we waive the parts of our Terms of Service and Acceptable Use Policy that would otherwise forbid it, such as the ban on scanning or probing TrueProxies infrastructure. If someone else takes legal action against you over research you did under this policy, we will make it known that you had our authorization.
If you are unsure whether something is allowed, ask us at hello@trueproxies.com before you test it.
What happens next
We read every report, confirm we received it and keep you updated while we work on a fix. We do not promise a fixed reply time.
Rewards
We do not pay rewards for reports. If you would like, we will thank you by name once the issue is fixed.