COMPANY / Twinlike
Vulnerability Disclosure
How to report a security vulnerability in Twinlike websites and products, what is in scope, and our responsible disclosure rules.
We take the security of our systems seriously. If you have found a vulnerability in our websites or products, please let us know. We welcome reports made in good faith and work to fix them quickly, together with you.
How to report
Send your report to security@twinlikee.com. If you can, include:
- The address, page or component where the issue is
- Steps to reproduce it (with a screenshot or short video if helpful)
- The possible impact
- How we can reach you
Reports can be in English or Turkish.
Scope
- twinlikee.com and its subdomains
- Twinlike Coder (the desktop app and coder.twinlikee.com)
- Digger
Our clients’ websites and third-party services are not covered by this policy.
Our commitment
- We confirm receipt of your report within 3 business days.
- We investigate, and if we confirm the issue we keep you updated on the fix.
- We will not take legal action over research done in good faith and within these rules.
- If you wish, we credit you by name once the issue is fixed.
Please do not
- Run tests that disrupt the service (DoS, load testing, heavy automated scanning)
- Access, change or delete data that belongs to others
- Try social engineering, phishing or physical access
- Share details publicly before the issue is fixed
If you come across personal data while confirming an issue, please stop there, do not keep the data, and tell us right away.
This policy is also published as a security.txt file (RFC 9116).
We do not run a bounty programme at the moment. We thank you for every valid report and keep you updated while we fix it.
Client websites are not covered by this policy, so please report it to that company directly. If you know we manage the site, you can also write to security@twinlikee.com and we will pass the report on.
