Found something? Tell us directly.

How to report

Email [email protected]. Please don't file suspected vulnerabilities in public trackers, and don't include exploit details in any public channel before we've had a chance to respond.

Helpful contents: the component and version (e.g. engine 0.0.1-preview, an SDK, this website), reproduction steps or a proof of concept, the impact as you understand it, and how you'd like to be credited — or not.

Scope

• In scope: the TulaDB software — engine, SDKs, REST gateways, dashboard, exporter, installers — and the tuladb.com website.
• Test on your own deployments. TulaDB is self-hosted software: install it locally or in your own environment and probe it there as hard as you like. Never test against a deployment you don't own or have permission to test.
• Out of scope: denial-of-service against tuladb.com, social engineering, physical attacks, and findings that require a configuration our docs already describe as unsafe for production (for example, the loopback-only demo profile).

What you can expect from us

• An acknowledgement, normally within three business days. (Pilot and general enquiries are answered within one business day.)
• An honest assessment, a fix or mitigation timeline once triaged, and updates while we work.
• Credit in the fix's release notes if you want it.
• No legal action for security research conducted in good faith that respects this policy — reported privately, no data taken beyond what's needed to demonstrate the issue, no harm to systems or people.

Preview status

TulaDB is in developer preview. Some hardening work is known, scheduled, and documented — the security docs describe what's shipped versus opt-in versus your deployment's responsibility. A report that tells us our documentation overstates something is as valuable as a memory-safety bug, and will be treated with the same seriousness.