Found a vulnerability?
We want to hear from you.

Write to security@theoremic.com. Tell us what you found, where you found it, and enough detail that we can reproduce it.

We will acknowledge your report within 48 hours.

We will tell you what we have found and what we intend to do about it, and we will keep you updated while we work on it.

We will not pursue legal action against you for research conducted in good faith under this policy, and we will not ask your employer or anyone else to do so on our behalf.

We will credit you publicly if you want us to, and we will keep you anonymous if you do not.

Give us a reasonable window to fix the issue before you disclose it publicly. Ninety days is our default; if it needs longer we will tell you why, and if you think it needs to be shorter, tell us.

Do not access, modify or download data that is not yours. If you come across customer data, stop and tell us.

Do not degrade our service or anyone else's. No denial of service, no automated scanning that generates significant load, no social engineering of our team or our customers, and no physical intrusion.

Work only against systems we run. Do not test a customer's environment.

In Scope

theoremic.com and its subdomains, and any infrastructure we operate directly.

Out of Scope

Systems belonging to our customers or our vendors, including a customer's own cloud environment where Theoremic is deployed. If you believe you have found a vulnerability in a customer deployment, write to us and we will coordinate with them. Please do not contact them directly.

Also out of scope: findings from automated scanners without a demonstrated impact, missing best-practice headers with no exploitable consequence, rate limiting on non-authenticated endpoints, social engineering, and issues requiring physical access to a device.

We are an early-stage company and we do not run a paid bug bounty program yet. We will say so honestly rather than imply otherwise. What we can offer is a fast response, a real conversation with the people who wrote the code, credit if you want it, and a place on the list when we do start paying.