Security

This page is the public coordinated-disclosure policy for Team Trajectory. Our source repository is private, so this page — not a repo file — is the canonical version of this policy.

How we protect your data

• Encryption in transit (TLS/HTTPS) for all traffic.
• Passwords, and password-reset / email-verification / session (refresh) tokens, are one-way hashed — raw tokens are never stored.
• Short-lived access tokens backed by revocable, rotating server-side sessions.
• The browser sign-in token is held in a protected (httpOnly) cookie, never exposed to page scripts.
• Role-based access controls scoped per team.
• Rate limiting on authentication endpoints.

Reporting a vulnerability

Found a security issue? Email security@teamtrajectory.app with the affected URL or endpoint, steps to reproduce, and your assessment of impact.

We will acknowledge your report within 72 hours and send a status update within 7 days. We do not currently offer a paid bug bounty, but we're grateful for responsible disclosure.

Safe harbor

If you make a good-faith effort to comply with this policy — no data exfiltration beyond what's needed to prove a proof-of-concept, no access to other users' data, no denial-of-service testing, no social engineering, and you stop immediately at the first sign you've reached another real user's actual data (and report that as part of your disclosure) — we will not pursue or support legal action against you for your research.

Machine-readable version: /.well-known/security.txt on this domain and on app.teamtrajectory.app. Questions about your own data or privacy rights go to privacy@teamtrajectory.app instead — see our Privacy Policy.