Report a security problem to security@tollrelay.com.
If you find a weakness in TollRelay, tell us before anyone else and give us time to fix it.
How to report
Email security@tollrelay.com, in English. The same address is published in security.txt.
What to include
What you found and where: the address or the command, what you sent and what came back, and the steps that show it again. Say which account or organisation you used, if any. Leave out any personal data you came across.
What happens to a report
Each report is acknowledged, and its outcome is recorded. We tell you whether we could reproduce the problem and what we changed. A problem that reached anyone's data or service is handled as an incident: the people affected are told within twenty four hours of it being confirmed.
What is in scope
tollrelay.com, including the dashboard at tollrelay.com/org and sign-in at auth.tollrelay.com. The API, at api.trlay.dev and api.tollrelay.com. trlay.sh, where test versions run.
What is not
Testing that floods a service or slows it for others, tricking people at TollRelay or at its customers, and the services of the companies TollRelay buys from. Report a problem with one of those to that company.
Research in good faith
If you follow this page in good faith, Hoosei Limited, which operates TollRelay, will not take legal action against you for your research and will not ask anyone else to. Good faith means you test only accounts you own or may use, you stop and report as soon as you reach data that is not yours, you do not keep, share or change that data, you do not slow the service for others, and you give us reasonable time to fix a problem before you speak about it in public.