Vulnerability disclosure policy

CloseDesk is a product of Trianzor (trianzor.com). In this policy, “we” and “us” mean Trianzor. We welcome reports from security researchers, customers and anyone else who finds a weakness in CloseDesk. This policy says what you may test, how to report it, and what you can expect from us.

Report to security@trianzor.com. We acknowledge every report within 3 business days. Our contact details are also published at /.well-known/security.txt.

What’s in scope

Service	Address	Testing allowed
The CloseDesk website	closedesk.in	Yes
The CloseDesk application, including the platform admin console	app.closedesk.in	Yes, with accounts you create yourself
The CloseDesk Slack app: installing it (Add to Slack), its OAuth redirect, the events it receives, App Home and the messages it posts	app.closedesk.in/slack.php, app.closedesk.in/slack-events.php, closedesk.in/slack	Yes, in a Slack workspace you own
The public REST API and webhooks we send	app.closedesk.in/api/v1	Yes, with API keys from your own account
The Tally connector (the script customers run next to Tally) and the endpoint it talks to	app.closedesk.in/connector.php	Yes, against your own Tally data
The public demo	demo.closedesk.in	Low-impact testing only
The preview environment (beta builds)	preview.closedesk.in	Low-impact testing only

The demo resets every night and the preview is for our internal testing, so on both please keep to manual, low-volume checks: no automated scanning, load or brute-force attempts, and nothing that changes data other visitors see.

A free Solo account at app.closedesk.in is enough to test most of CloseDesk. If you need a paid plan’s features (the API and webhooks are on Enterprise), write to us first and we’ll set up a test account.

What’s out of scope

• Customers’ own CloseDesk servers (on-premise installs) and anything you don’t own, unless the owner has given you written permission.
• Services we use but don’t run: Slack, Tally, Zoho Books, Razorpay, Google and Microsoft sign-in, our hosting and email providers. Please report problems in those to the company that runs them.
• Denial of service, load or stress testing, and anything that slows CloseDesk down for others.
• Social engineering, phishing or physical attacks on our staff, partners or customers.
• Spamming our forms, sign-up or support desk, or sending mail to people through CloseDesk.
• Reports from automated scanners without a working proof of the problem.
• Missing security headers, cookie flags, SPF, DKIM or DMARC settings, or TLS configuration choices, unless you can show how they lead to harm.
• Clickjacking on pages with no sensitive action, logout CSRF, self-XSS, and issues that need an unlikely amount of user interaction.
• Problems that need an out-of-date browser, a rooted device or an attacker who already controls the victim’s computer.
• Disclosure of software versions or other information that doesn’t lead to a vulnerability.

How to test

• Use only accounts, companies, Slack workspaces, API keys and Tally data that you created yourself.
• If you reach data that isn’t yours, stop. Don’t view more than you need to show the problem, don’t keep or share it, and tell us straight away.
• Don’t change or delete data, run destructive tests, or keep access open longer than you need to show the problem.
• Keep automated requests to a gentle rate.
• Keep the problem confidential until we have fixed it, or until 90 days after your report, whichever comes first. If we need longer we’ll explain why and agree a date with you.

How to report

Email security@trianzor.com in English. Please include:

• which service it affects (website, app, Slack app, API, webhooks or Tally connector) and the address or screen;
• the steps to reproduce it, with any requests, screenshots or a short video;
• what an attacker could do with it, as you see it;
• how you’d like to be credited, if at all.

Please don’t put other people’s data in your report. If you’d like to send it encrypted, ask in your first email and we’ll arrange it.

What you can expect from us

• Within 3 business days: we confirm we have your report.
• Within 10 business days: we tell you whether we can reproduce it and how serious we think it is.
• Until it’s fixed: an update at least every 14 days. We aim to fix critical problems within 30 days.
• When it’s fixed: we let you know, and with your permission thank you by name.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We won’t take legal action against you or report you to law enforcement for it, and if someone else does, we’ll make it known that you acted with our authorisation. If you’re unsure whether something you want to try is allowed, ask us at security@trianzor.com before you do it.

This safe harbour covers only systems that we run and that are in scope above. We can’t authorise testing of other companies’ services, including Slack, Tally or Zoho Books, or of a customer’s own server.

No bug bounty

We don’t run a paid bug bounty and don’t pay for reports. We’re grateful for every report and are glad to credit you publicly if you’d like.

Changes

We may update this policy. The date at the top shows when it last changed. The Security page describes how CloseDesk protects your data.