Data security is a top priority for Twingate, and Twingate believes that working with skilled security researchers can identify weaknesses in any technology.

If you believe you’ve found a security vulnerability in Twingate’s service, please notify us; we will work with you to resolve the issue promptly.

Disclosure Policy

• If you believe you’ve discovered a potential vulnerability, please let us know by emailing us at security [at] twingate.com.
• Provide us with a reasonable amount of time to resolve the issue before disclosing it to the public or a third party. We aim to resolve critical issues within 5 business days of disclosure.
• Make a good faith effort to avoid violating privacy, destroying data, or interrupting or degrading the Twingate service. Please only interact with accounts you own or for which you have explicit permission from the account holder.
• Do not exploit a security issue you discover, including for the purpose of demonstrating additional risk by compromising sensitive data.
• This policy does not authorize you to access data that is not yours (including user data, Twingate data, and any personal data).
• View Vulnerability Reporting Acknowledgements

Rules

You must follow these rules when engaging in security research activities:

• Don’t intentionally disrupt our services.
• Don’t violate the privacy of other users, or alter or destroy data.
• Don’t exploit a vulnerability for your own benefit or the benefit of a third party.
• Target your own accounts when investigating any potential bugs. Don’t attempt to access the accounts of other users.
• Don’t target any physical security measures.
• If you discover a severe vulnerability that permits systems access, please report the vulnerability immediately and do not proceed further.
• Prioritization and approach to how bugs should be addressed will be at Twingate’s sole discretion.
• Don’t exhibit any threatening behavior when reporting bugs and interacting with Twingate personnel.
• Keep bug disclosure communications with Twingate confidential. Please do not disclose bug details to any third party unless Twingate has consented.
• Researchers must destroy all artifacts created to document vulnerabilities (POC code, videos, screenshots) after the bug report is closed.

Out of Scope Endpoints and Systems

• Twingate Company Site (www.twingate.com)
• Twingate Documentation Site (docs.twingate.com)
• Twingate Forums (forum.twingate.com)
• Twingate Status Site (status.twingate.com)
• Twingate Support Site (help.twingate.com)
• Twingate Trust Center Site (trust.twingate.com)
• The following subdomains: email, packages, sales
• Vulnerabilities on sites hosted by third parties unless they lead to a weakness on any in-scope endpoint or system

Out of Scope Vulnerabilities

While researching, we’d like you to refrain from:

• Distributed Denial of Service (DDoS)
• Spamming
• Any attacks against Twingate’s physical property or data centers

Reporting Vulnerabilities

If you believe you’ve discovered a potential vulnerability, please let us know by emailing us at security [at] twingate.com. We will acknowledge receipt of your email within 5 business days. In your email you should describe the vulnerability in as much detail as you can, and include detailed steps on how to reproduce it. Reports should not relate to anything considered out-of-scope under this policy. All assessments are considered final. Thank you for helping to keep Twingate and our users safe!

Changes

We may revise these guidelines from time to time. The most current version of the guidelines will be available at https://docs.twingate.com/docs/responsible-disclosure-policy.

Contact

Twingate is always open to feedback, questions, and suggestions. If you would like to talk to us, please feel free to email us at security [at] twingate.com.

Last updated: 8/25/2022