Report a vulnerability
If you believe you have found a security vulnerability in trg-digital.com, a website we have built, or an integration we run (including our JobAdder connector), email security@trg-digital.com. Please do not report security issues through the contact form or social media.
It helps us to receive:
- The page, URL or feature affected.
- What the issue is and what an attacker could do with it.
- Steps to reproduce it, with any proof-of-concept requests or screenshots.
- How you would like to be credited, if at all.
What happens next
- We acknowledge your report within 2 business days.
- We investigate, confirm the issue and tell you how serious we think it is.
- We fix critical issues within 7 days and others as quickly as their severity warrants, and keep you updated until the fix is live.
- If the issue affected anyone's data, we tell the people and organisations affected, including any partner whose data was involved, within 72 hours of confirming it.
- With your permission, we credit you once the fix is live.
What we ask of you
- Only test against your own accounts and data. Do not access, change or delete other people's data; if you reach any by accident, stop and tell us.
- Do not run denial-of-service tests, spam, or social engineering against us, our clients or our suppliers.
- Do not use automated scanners at a volume that degrades the service.
- Give us reasonable time to fix the issue before you share details publicly.
We will not take legal action against anyone who reports a vulnerability in good faith and follows these guidelines.
How we protect data
- All traffic to our sites is encrypted with HTTPS, and browsers are told never to connect without it.
- Our database is hosted in London and encrypted at rest.
- Our code is scanned automatically for vulnerable dependencies, insecure code and leaked secrets on every change, and our live site is scanned weekly.
- Admin access is limited to named people and requires a sign-in link sent to their own email address.
For how we handle personal data, see our privacy notice.