Security and Vulnerability Reporting

Report safely

• Describe the affected URL or component and the observed behavior.
• Use your own account and data.
• Provide minimal reproduction steps and redact secrets.
• Do not include private documents or precise locations in the initial report.
• Stop if testing could expose another person’s information, alter data, or impair service.

Prohibited testing

• Denial of service or excessive automated traffic
• Social engineering, phishing, or physical attacks
• Accessing, changing, retaining, or publishing another user’s data
• Malware distribution or persistence
• Testing third-party providers without their permission
• Public disclosure before a reasonable investigation and remediation period

Our response

Reports will be assessed based on impact, reproducibility, affected users, and exploitability. Marine may request additional safe evidence, coordinate a remediation timeline, and notify affected users or authorities where required. A report does not authorize activity that would otherwise be unlawful.

Protect credentials

Marine staff will not ask for your password. Never send passwords, MFA secrets, recovery codes, session cookies, signed login links, private keys, or production API credentials in a report.

Authoritative references

• Tocsin Data