---
title: Security
description: How to report a security problem in TollRelay, what to include, what happens next and what is in scope.
canonical: https://tollrelay.com/security
lastmod: 2026-10-04
---

# Report a security problem to security@tollrelay.com.

If you find a weakness in TollRelay, tell us before anyone else and give us time to fix it.

Email a report: mailto:security@tollrelay.com?subject=Security%20report

## How to report

Email security@tollrelay.com, in English. The same address is published in [security.txt](https://tollrelay.com/.well-known/security.txt).

## What to include

What you found and where: the address or the command, what you sent and what came back, and the steps that show it again. Say which account or organisation you used, if any. Leave out any personal data you came across.

## What happens to a report

Each report is acknowledged, and its outcome is recorded. We tell you whether we could reproduce the problem and what we changed. A problem that reached anyone's data or service is handled as an incident: the people affected are told within twenty four hours of it being confirmed.

## What is in scope

tollrelay.com, including the dashboard at tollrelay.com/org and sign-in at auth.tollrelay.com. The API, at api.trlay.dev and api.tollrelay.com. trlay.sh, where test versions run.

## What is not

Testing that floods a service or slows it for others, tricking people at TollRelay or at its customers, and the services of the companies TollRelay buys from. Report a problem with one of those to that company.

## Research in good faith

If you follow this page in good faith, Hoosei Limited, which operates TollRelay, will not take legal action against you for your research and will not ask anyone else to. Good faith means you test only accounts you own or may use, you stop and report as soon as you reach data that is not yours, you do not keep, share or change that data, you do not slow the service for others, and you give us reasonable time to fix a problem before you speak about it in public.