Security Policy

1. Our commitment

We welcome reports of security vulnerabilities, from researchers and from anyone else who finds one, and we deal with them promptly.

2. Scope

This policy covers truehome.ie. Progressa (progressa.ie) is also a product of True Home Properties Limited, and you can report issues with it to the same address.

The following are out of scope:

• Vulnerabilities in the third-party services we use, such as Vercel, Google and Cloudflare. Please report those to the vendor.
• Social engineering or phishing aimed at our staff.
• Physical security.
• Denial-of-service testing.

3. How to report a vulnerability

Email security@truehome.ie with:

• A description of the vulnerability and its potential impact.
• Steps to reproduce it.
• The URLs involved, and any screenshots or proof-of-concept code.
• Your contact details, if you would like a reply. Anonymous reports are welcome.

4. What happens next

We will acknowledge your report within 3 business days, investigate it, keep you informed, and let you know when it is fixed.

5. Guidelines

• Give us reasonable time to fix the issue before you disclose it publicly.
• Do not access, change or delete anyone else's data.
• Do not disrupt the site, and do not run heavy automated scans against it.
• Do only what is needed to demonstrate the issue.

If you act in good faith and follow these guidelines, we will not take legal action against you in relation to your research.

6. Recognition

We do not run a paid bug bounty, but with your permission we are glad to credit researchers who report confirmed issues.

7. Contact

Security reports: security@truehome.ie. Our machine-readable contact details are at /.well-known/security.txt.