Responsible Vulnerability Disclosure

1. Guidelines for researchers

When investigating potential vulnerabilities in our systems, we ask that you:

• Notify us as soon as possible after identifying a real or potential problem.
• Avoid privacy violations, degrading other users' experience, disrupting production systems or destroying/altering data.
• Use exploits only to the extent necessary to confirm the existence of the vulnerability, not to exfiltrate data, obtain persistent access or pivot to other systems.
• Give us a reasonable period to fix the problem before any public disclosure.
• Avoid sending a large volume of low-quality reports or reports generated by automated scanners without manual validation.
• If you come across sensitive data (personal data, financial information, trade secrets) during testing, stop immediately, let us know and do not share or retain that data.

2. Unauthorized testing methods

• Denial-of-service (DoS/DDoS) tests or any test that impairs the availability of systems or data.
• Social engineering (phishing, vishing) or physical security testing against staff or facilities.

3. Scope

In scope for this policy:

• The web application at app.tangerinai.com.br and app.tangerinai.com.
• The institutional website at tangerinai.com.br and tangerinai.com.
• The APIs exposed under these domains.
• The Tangerin AI Agent binary and the Tangerin AI browser extension, when tested in an environment controlled by the researcher themselves (their own workstation, with a trial or test account).

Out of scope:

• Infrastructure of our subprocessors (e.g., Vercel, Supabase): vulnerabilities in these systems must be reported directly to the respective vendor.
• Testing against workstations, accounts or environments of third parties (other Tangerin AI customers) without their and our express written authorization.
• Any system not listed above, unless authorized in advance and in writing by Tangerin AI.

4. How to report

Send your report to seguranca@tangerinai.com. Reports may be submitted anonymously. To help us triage and prioritize, we recommend including:

• Description of the vulnerability and the potential impact of its exploitation.
• Detailed steps to reproduce (proof-of-concept scripts or screenshots help).
• Language: Portuguese or English.

5. What you can expect from us

• Acknowledgment of receipt within 5 business days, if you share a contact.
• Transparent communication about the progress of the fix, including any reasons for delay.
• Open dialogue throughout the remediation process.

We may depart from these timelines in exceptional situations, for example, imminent risk to customers that requires faster disclosure, or legal obligations that require disclosure within a different period.

6. Safe harbor

We consider security research conducted in good faith and in accordance with this policy to be an authorized activity. We will not initiate or support legal action against researchers who reasonably follow these guidelines, even if, in the course of the research, they have accessed data beyond what is strictly necessary to confirm the vulnerability, provided it is reported immediately and without misuse, in accordance with Section 1.

This safe harbor does not apply to testing that violates Section 2 (unauthorized methods) or that is outside the scope defined in Section 3.

7. Recognition

We do not operate a financial reward program (bug bounty) at this time. Upon request and at our discretion, we may publicly recognize researchers who report valid vulnerabilities, if they wish.

8. Revisions to this policy

We may revise this policy periodically. Changes will be published on this page.

9. Contact