Introduction

Thira welcomes good-faith security research and wants to hear about vulnerabilities in our products and infrastructure. We take the security of our customers' data seriously, and we believe that working with the security community is one of the best ways to find and fix weaknesses before they can be exploited.

This policy explains what systems are covered, how to report a finding, what you can expect from us, and the protections we extend to researchers who follow it. If you have discovered something you believe is a security issue, we want to know about it. Please read this policy in full before testing or reporting.

Scope

This policy applies to the following systems and services that Thira owns and operates:

  • thira.com and all subdomains of thira.com
  • The Thira web application and its APIs
  • Thira-published integrations, SDKs, and client libraries
  • Infrastructure that Thira directly controls and that is reachable from the Internet

The following are out of scope. Do not test them, and do not report findings against them under this policy:

  • Systems operated by third parties, including our hosting, payment, authentication, and email providers. Report issues in those services directly to the vendor under their own disclosure policy.
  • Social engineering, phishing, vishing, or any attack that targets Thira employees, contractors, or customers
  • Physical attacks against Thira offices, equipment, or personnel
  • Denial-of-service testing, resource exhaustion, or any activity that degrades service for other users
  • Automated scanning or fuzzing at volumes that generate significant traffic or log noise
  • Findings that require a compromised or jailbroken device, a malicious browser extension, or physical access to a victim's device
  • Reports from automated tools without a demonstrated, exploitable impact
  • Missing security headers, missing DNS records (SPF, DKIM, DMARC), or version disclosures that do not lead to a demonstrated vulnerability
  • Clickjacking on pages with no sensitive actions
  • Self-XSS, or issues that require a victim to paste code into their own browser
  • Rate-limiting or brute-force findings on non-authentication endpoints

How to report a vulnerability

Send reports to security@thira.com. This mailbox is monitored by the Thira security team and is the only channel covered by this policy. Reports sent to other addresses, support channels, or social media are not guaranteed a response and are not protected by the safe harbor below.

Your initial email does not need to contain full details. A brief summary and the type of vulnerability is enough to get started. Once we acknowledge your report, we will exchange a safe way to encrypt the detailed information before you send it.

A useful report includes:

  • The affected URL, endpoint, product, or component
  • The type of vulnerability (for example, IDOR, stored XSS, authentication bypass)
  • Step-by-step instructions to reproduce the issue, including any request and response details
  • A proof of concept, screenshot, or short video where it helps
  • Your assessment of the impact: what an attacker could do and whose data is affected
  • Any accounts, test data, or identifiers you created or used during testing, so we can clean them up
  • How you would like to be credited, if at all, and whether we may contact you with questions

You may report anonymously. If you do, we cannot update you on the status of your report or credit you, but we will still act on it.

Please send one report per vulnerability. If you find several related issues, note the relationship in each report.

What you can expect from us

When you report under this policy, Thira commits to the following:

  • Acknowledge receipt of your report within 10 business days
  • Confirm whether the issue is valid and in scope within 25 business days
  • Give you a status update on remediation at least every 45 days while the issue is open
  • Remediate confirmed vulnerabilities in priority order by severity, with critical issues addressed as fast as practicable
  • Notify you when the fix is deployed

We will work with you in good faith to understand and validate your report, keep you informed as we investigate, and let you know when the issue is resolved. We will not share your name or contact details outside the security team without your permission.

Thira does not currently operate a paid bug bounty program and does not offer monetary rewards for reports at this time. We may offer public recognition as described below. We do not award or credit duplicate reports; if an issue has already been reported or is already known to us, we will tell you.

Guidelines for researchers

To stay within this policy, you must:

  • Test only systems listed as in scope, and respect the out-of-scope list above
  • Use only accounts you own or have explicit permission to use. Create your own test accounts rather than accessing other users' accounts or data.
  • Stop testing and report immediately if you encounter personal data, customer data, credentials, or proprietary information that is not your own. Do not view, copy, download, store, or share it beyond the minimum needed to demonstrate the issue.
  • Make a good-faith effort to avoid privacy violations, data destruction, and disruption or degradation of Thira services
  • Limit exploitation to what is necessary to confirm a vulnerability exists. Do not pivot to other systems, escalate privileges beyond the proof of concept, or establish persistence.
  • Delete any data you obtained during testing once the report is submitted, and tell us what you held
  • Report the vulnerability to security@thira.com as soon as reasonably possible after discovery
  • Keep the details confidential until Thira confirms the issue is resolved, as described in the confidentiality section below
  • Comply with all applicable laws

You must not:

  • Perform denial-of-service, resource-exhaustion, or spam attacks
  • Use social engineering, phishing, or physical intrusion against Thira staff, contractors, customers, or facilities
  • Introduce malware, backdoors, or persistent access
  • Modify, delete, or exfiltrate data that is not your own
  • Demand payment or any other consideration in exchange for reporting, withholding, or not disclosing a vulnerability
  • Disclose the vulnerability publicly or to third parties before Thira has resolved it and agreed to disclosure

Safe harbor

Thira considers security research and vulnerability disclosure conducted in accordance with this policy to be authorized. If you make a good-faith effort to comply with this policy during your research, we will:

  • Consider your research authorized under the Computer Fraud and Abuse Act (CFAA), the Washington Computer Trespass statute, and similar state and foreign laws, and will not initiate or support legal action against you for accidental, good-faith violations of this policy
  • Consider your research exempt from the anti-circumvention provisions of the Digital Millennium Copyright Act (DMCA), and will not bring a claim against you for circumventing technological measures we use to protect in-scope systems
  • Consider your research a limited exception to any restrictions in Thira's Terms of Service and Acceptable Use Policy that would otherwise prohibit it, and waive those restrictions to the extent they conflict with this policy
  • Treat your report as confidential and not share your identity with third parties without your permission, except as required by law
  • Work with you to understand and resolve the issue quickly

If a third party initiates legal action against you for activity that Thira believes was conducted in compliance with this policy, Thira will make it known that your actions were authorized under this policy.

This safe harbor applies only to the systems in scope and only while you comply with this policy. It does not authorize testing of third-party systems, even where they are used by Thira, and it does not cover activity that this policy prohibits. You are responsible for complying with laws that apply to you, including laws in your own jurisdiction. If you are unsure whether a planned activity is covered, ask us at security@thira.com before you proceed.

This policy is not an offer of employment or a contract, and does not create any obligation on Thira beyond what is stated here.

Confidentiality and coordinated disclosure

Vulnerability details are confidential until Thira has remediated the issue and both parties agree that disclosure is appropriate. This protects Thira's customers while a fix is being developed and deployed.

By submitting a report, you agree to:

  • Keep all information about the vulnerability, the affected systems, and any data you encountered confidential
  • Not share the vulnerability with any third party, including other researchers, vulnerability brokers, media, or public forums, until Thira confirms in writing that the issue is resolved
  • Not publish, present, or otherwise disclose the vulnerability without coordinating the content and timing with Thira in advance

Thira commits to a coordinated disclosure window of 90 days from the date we acknowledge your report. If we have not remediated the issue within 90 days, we will discuss an extension with you and explain the reason. If we cannot agree, you may disclose after the window closes, provided you give us at least 14 days' notice of your intended publication date and omit any customer data or details that would meaningfully aid exploitation of unpatched systems.

Where a fix requires customer action (for example, a configuration change or credential rotation), we may ask for additional time so that customers can act before details become public.

We will tell you when the issue is fixed and, if you wish, work with you on a mutually agreed public disclosure. We ask that any public write-up not include customer data, personal data, or working exploit code for issues that remain unpatched elsewhere.

Thira will treat your report, your identity, and your contact details as confidential. We will not share them outside the people needed to investigate and fix the issue, except as required by law or with your consent.

Recognition

With your permission, Thira will credit researchers who report valid, in-scope vulnerabilities on a public acknowledgments page once the issue is resolved. Tell us in your report how you would like to be named (name, handle, or link), or that you prefer not to be listed. Only the first valid report of an issue is credited; duplicates are not awarded.

Changes to this policy

Thira may update this policy at any time. The version published at https://thira.com/security applies to research conducted on or after its effective date. Material changes will be noted with a new effective date at the top of the page.

Questions about this policy can be sent to security@thira.com.