Vulnerability disclosure program

How to report a security issue in Tessera, and what we promise in return.

Tessera holds things people would not want made public. If you have found a way to reach data you should not be able to reach, we would rather hear it from you than read about it somewhere else. This page tells you how to tell us, what you may and may not do while looking, and what we commit to when you do.

What we commit to

• We will acknowledge your report within 5 business days.
• We will tell you our assessment, and whether we are fixing it, within 30 days.
• We will keep you updated while we work on a fix, and tell you when it ships.
• We will not pursue legal action against you for good-faith research that stayed inside the rules below, and we will not report you to law enforcement for it. The prohibition on probing and scanning in section 8 of our Terms of Service does not apply to research conducted under this program.
• If you would like credit, we will name you when we publish the fix. If you would rather not be named, we will not name you.

We do not currently pay bounties. That may change; it is not a promise. Reports are welcome either way.

In scope

• The Tessera mobile app for iOS and Android
• app.your-tessera.com, the Tessera web app
• api.your-tessera.com, the Tessera API
• your-tessera.com and authorityindexlabs.com

Out of scope

These are either not ours to fix or not things we consider vulnerabilities. Reports limited to them will be closed politely.

• Third-party services we build on, including our hosting, database, payment, subscription and AI providers. Report those to the provider. If you find a way to abuse one of them through Tessera, that is in scope and we want to know.
• Denial of service, volumetric testing, or anything that degrades the service for other people.
• Social engineering of our staff, users, or vendors, and physical attacks on any premises.
• Findings from an automated scanner with no demonstrated impact, and missing best-practice headers or configuration with no working exploit.
• Rate limiting or brute-force concerns without a demonstrated bypass.
• Issues requiring a rooted or jailbroken device, a compromised account, or physical access to an unlocked phone.
• Reports about software versions, without a working proof of concept against our systems.

Rules for research

These exist because our users are real people and their data is real. Breaking them takes you outside the program, and outside the protection above.

• Use your own account. Never access, modify, download, or store another person's data. If you find a way to reach someone else's data, stop at the point of proof: capture only enough to demonstrate it, and tell us.
• Do not degrade the service. No load testing, no denial of service, no automated scanning that generates significant traffic.
• Do not exfiltrate. Do not remove data from our systems, and delete anything you incidentally obtained once you have reported it.
• Do not persist. No backdoors, no maintaining access, no lateral movement beyond what is needed to demonstrate the issue.
• Give us time. Please do not disclose publicly until we have shipped a fix, or 90 days have passed from your report, whichever comes first. If we need longer, we will ask rather than assume.
• Follow the law. This program cannot authorise anything a third party has not authorised.

If you find user data exposed

Tell us immediately, before doing anything else, at support@authorityindexlabs.com. Do not download it, do not share it, and do not use it to demonstrate further issues. We will treat that report as our highest priority and respond the same day where we can.

Authority Index Labs, Inc. · Nashville, TN · Terms of Service · Privacy Notice
Last updated August 1, 2026