Responsible Disclosure Policy

How to report

Email hello@thora.cloud with "Security" in the subject. Include what you found, where, the steps to reproduce it, and the impact you think it has. We will acknowledge your report within three business days and keep you updated until it is fixed.

In scope

• thora.cloud and its subdomains operated by Thora.
• Thora One Business, the Thora Business apps and Thora AI.

Rules

• Use only your own accounts and test data. Do not access, change or delete other people's data; if you reach it by accident, stop and tell us.
• No denial-of-service, spam, social engineering, phishing or physical attacks.
• No automated scanning that creates heavy load.
• Give us reasonable time to fix the issue before sharing it publicly, and do not share data you obtained.

Safe harbor

If you act in good faith and follow this policy, we will not pursue legal action against you for your research, and we will treat it as authorized under our Terms and the Acceptable Use Policy. We do not run a paid bug bounty today, but we are glad to credit you publicly if you would like.

Security.txt

Our contact details are also published at /.well-known/security.txt.