Security Vulnerability Disclosure Policy

1. Reporting

Please report suspected vulnerabilities to security@tako.tax with enough detail to help us reproduce and understand the issue.

2. Good-faith expectations

Please act in good faith, avoid privacy violations, avoid destructive testing, and do not access or attempt to access data that does not belong to you.

3. Response

TakoTax will make reasonable efforts to:

• Acknowledge receipt of reports
• Investigate credible reports
• Prioritize remediation based on severity and risk

4. Scope

This Policy applies to security issues involving TakoTax's own systems and services — for example, the TakoTax websites at www.tako.tax and app.tako.tax. It does not extend to third-party services TakoTax relies on, and it does not permit testing that is unlawful, harmful, or disruptive, or that accesses, modifies, or destroys data belonging to others.

5. Safe harbor

If you make a good-faith effort to comply with this Policy during your research, TakoTax will consider your research authorized, will not pursue or support legal action against you — including under the Computer Fraud and Abuse Act (18 U.S.C. § 1030) or applicable state computer-crime laws — for accidental, good-faith violations of this Policy, and will not report you to law enforcement. This authorization is limited to TakoTax's own systems and does not authorize action that affects third parties, third-party services, or data belonging to others. If a third party brings legal action against you for activity you carried out in good-faith compliance with this Policy, TakoTax will make this authorization known. If you are unsure whether specific testing is consistent with this Policy, contact security@tako.tax before you proceed.

6. No bounty commitment

Unless TakoTax announces otherwise, submission of a report does not create an entitlement to payment or reward.

7. Contact

Security reports should be sent to security@tako.tax.