Terebyte
Get started

Report a vulnerability

Updated October 12, 2026

If you think you’ve found a security problem in Terebyte, please tell us. We’d rather hear about it from you than from anyone else. This policy says how to report it, what we ask of you, and what we promise in return.

How to report

  1. Email security@terebyte.com with what you found, where, and the steps to reproduce it. A short proof of concept helps.
  2. Tell us how you’d like to be credited, or that you’d rather not be.

We reply within 5 business days to say we have it and what happens next, then keep you updated until it’s fixed. This is also listed in /.well-known/security.txt.

In scope

  • terebyte.com, including the app and share links;
  • connect.terebyte.com;
  • our download servers, dl1.terebyte.com and dl2.terebyte.com;
  • the encryption design described on How zero-knowledge works.

Out of scope

  • the services of the companies that help us run Terebyte (report those to them; the list is on Security);
  • denial of service, or anything that floods or slows the service;
  • social engineering of our staff or members, and physical attacks;
  • spam or sending email through our forms;
  • reports from automated scanners with no demonstrated problem.

What we ask of you

  • Test only against accounts you own, or have the owner’s permission to test.
  • Don’t access, change or delete anyone else’s information. If you come across any by accident, stop, tell us, and don’t keep or share it.
  • Don’t disrupt the service or degrade it for anyone else.
  • Give us a reasonable time to fix the problem before you tell anyone else, and agree a date for publishing with us.
  • Follow the law.

Safe harbor

If you act in good faith and follow this policy, Terebyte, Inc. considers your research:

  • authorized under anti-hacking laws, such as the US Computer Fraud and Abuse Act, and we won’t start or support legal action against you for accidental, good-faith breaches of this policy;
  • authorized under anti-circumvention laws, such as the US Digital Millennium Copyright Act, and we won’t bring a claim against you for getting around our technical controls;
  • exempt from anything in our Terms of Service that would stop you doing this research, which we waive for this purpose only;
  • lawful, helpful to the security of the internet, and done in good faith.

If someone else takes legal action against you for research that followed this policy, we’ll make it known that you acted with our authorization. If you’re unsure whether something is allowed, ask us first at security@terebyte.com.

Rewards

We don’t pay rewards for reports yet. With your agreement, we’ll thank you by name when the fix is published.

Report a vulnerability · Terebyte