Vulnerability reporting
How to report a suspected security issue in TextSend, what is in scope, and what to expect after you report.
1. Reporting address
Send security reports to support@textsend.app with the subject line "Security", so we can find them. TextSend does not yet have a dedicated security address; this page will name one when it does.
2. Scope
In scope:
- The TextSend Zendesk app and its ticket sidebar and navigation bar locations.
- The TextSend backend and its public API and webhook routes.
- TextSend's Amazon Web Services infrastructure, to the extent a reporter can observe it externally (for example, a misconfigured public endpoint).
Out of scope:
- Twilio's or Zendesk's own platforms, infrastructure, or APIs. Report those directly to Twilio or Zendesk.
- Denial-of-service or volumetric testing against production infrastructure.
- Social engineering against TextSend personnel or customers.
- Findings that require physical access to Amazon Web Services infrastructure.
3. What to include
- The affected component: Zendesk app location, backend route, or infrastructure resource.
- Steps to reproduce, including any request or response detail needed to confirm the issue. Redact any real Twilio or Zendesk credential, phone number, or message body before sending. TextSend does not need real customer data to triage a report and does not want to receive it.
- An impact assessment, for example cross-customer data access, credential exposure, signature bypass, or injection.
4. Safe harbour
TextSend will not pursue legal action against a good-faith security researcher who:
- reports a vulnerability through the address on this page rather than disclosing it publicly first;
- avoids privacy violations, data destruction, and service disruption while investigating;
- does not access, modify, or exfiltrate data belonging to a real customer or end customer beyond what is strictly necessary to demonstrate the vulnerability; and
- gives TextSend a reasonable opportunity to fix the issue before any public disclosure (see "Coordinated disclosure" below).
This safe harbour does not extend to activity that violates Twilio's or Zendesk's own terms of service, or applicable law.
5. Response targets
| Stage | Target |
|---|---|
| Acknowledgement of your report | 2 business days |
| Initial severity triage | 5 business days |
| Status updates on an open report | Every 10 business days until resolved |
| Fix for a confirmed critical or high-severity issue | Handled as a top-priority incident: immediate containment, then a fix, then a preventive test or alert before the incident closes |
These are targets, in line with how TextSend frames support response times (one business day for Pro, two business days for Starter, for ordinary support). They are not a contractual service level.
6. Coordinated disclosure
Please do not disclose a vulnerability publicly until it has been fixed, or until 90 days have passed since your initial report with no substantive progress communicated, whichever comes first.
TextSend will credit a reporter who asks for credit, once a fix has shipped, unless the reporter asks to remain anonymous.