Security

TapCanvas Labs, Inc. takes security seriously. Because TapCanvas runs code authored by users’ AI agents in a sandboxed environment, we welcome reports from security researchers.

Security leadership

Ernesto Badillo, Founder — responsible for engineering and security at TapCanvas Labs, Inc.

Reporting a vulnerability

Email security@tapcanvas.com with a description of the issue, the steps to reproduce it, and the impact you observed.

Vulnerability disclosure policy

In scope

• tapcanvas.com
• The TapCanvas web app
• The TapCanvas iOS app
• The sandboxed environment that runs user projects

Out of scope

• Third-party services we use
• Social engineering
• Physical attacks
• Denial-of-service or volumetric testing
• Spam

Researcher guidelines

• Only test against your own accounts and data.
• Do not access, modify, or delete other users’ data.
• If you reach another user’s data or escape the sandbox, stop and report it to us immediately.
• Give us reasonable time to fix an issue before you disclose it publicly — 90 days from your report by default.

Our commitments

• We acknowledge reports within 3 business days.
• We keep you updated as we investigate and fix the issue.
• We credit you for the finding if you want to be credited.

Safe harbor

We will not pursue legal action against good-faith security research that follows this policy.

Bug bounty

We don’t currently run a paid bug bounty program.