Report a security problem
If you find a weakness in Trilly's security, email security@trilly.io. We reply to say we've got it, usually within two working days.
Tosecurity@example.com
SubjectOrder pages show other people's orders
- What and where
- An order page shows someone else's order if I change its number.
- How to repeat it
- Open your order, then change 1042 in the address to 1041.
- What it could lead to
- Anyone could see other people's names and addresses.
- How to reach me
- This address.
How to report it
Please tell us:
What you found, and where (the page or address)
How to make it happen again
What someone could do with it
How to reach you
If you can't email, use our contact form and choose "Something else". Please keep the details out of public places, such as a review, a post or a skill's discussion, until it's fixed.
What we promise
- We look into it, and tell you whether we could confirm it and when it's fixed.
- If it puts people's information at risk, we treat it as an incident under our written plan.
- We ask you before naming you anywhere.
What this covers
Coveredtrilly.io and its pages, sign-in, the Trilly connector AI apps use (trilly.io/api/mcp) with its sign-in, and Trilly for Chrome, our browser extension.
Not coveredThe services of the companies that help us run Trilly (listed here) and the AI apps themselves: please report those to them. And any other website or address, even one that seems connected to Trilly.
The rules for testing
- Use only your own accounts, or test accounts you made. Never get into someone else's account or look at their information.
- If you come across someone else's information, stop, don't keep a copy, and tell us.
- Don't change or delete anything that isn't yours.
- Don't slow Trilly down for anyone else: no denial of service and no floods of requests.
- Never publish a harmful skill, a post or anything else where other people could see it or add it.
- Don't trick people, such as our team or anyone on Trilly, and don't try anything in person.
- Give us a fair chance to fix it before you tell anyone else, and agree a date with us.
If you follow these rules
If you act in good faith and follow the rules on this page, we won't pursue you for your research. This page can only speak for Trilly. It can't give permission on behalf of anyone else, such as the companies that help us run Trilly.
Our security.txt file points here. See also Security at Trilly.
Questions people ask
Do you pay for reports?
No. We don't run a paid bug bounty. We're grateful for every report, and we'll tell you what we did about yours.
Can I test Trilly's skill checks?
Please email security@trilly.io first and tell us what you'd like to test. The rules for testing on this page still apply.
What if the problem is in a skill, not in Trilly?
Use Report on the skill's page. We look at reports of unsafe skills within 24 hours.