T3 Tools
Vulnerability disclosure program on security.txt t3.codes
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 4
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 1 days
We aim to acknowledge complete reports within one business day, keep reporters informed of material progress, and coordinate disclosure after a fix is available.
- Safe harbor
-
Full
If you make a genuine effort to comply with this policy, avoid harm, respect privacy, and report findings promptly, we will treat your research as authorized and will not initiate legal action against you for accidental, good-faith violations of this policy.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
4 assets you may test, 1 excluded.
Web 2
- https://app.t3.codes
- https://t3.codes
Products and areas 2
- T3 Code desktop and mobile applications
- T3 Connect service
Out of scope (1)
- third-party services or infrastructure outside T3 Tools’ control
Rules
What the policy asks of you, and the bug types it won't reward, quoted from T3 Tools's policy. "We" in these lines means the program, not this site.
While testing
-
Test only accounts, data, and systems you own or have explicit permission to test;
-
Stop and report immediately if you encounter personal, confidential, or production data;
-
Access only the minimum information needed to demonstrate the issue;
-
Avoid disrupting availability, degrading performance, or damaging or deleting data;
-
Not use social engineering, phishing, physical attacks, or denial-of-service testing;
-
Not test third-party services or infrastructure outside T3 Tools’ control; and
-
Give us reasonable time to address the issue before public disclosure.
-
Do not send passwords, API keys, access tokens, or private keys in a vulnerability report.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.