Twine cut our access review cycle time by 76% and finally gave us the real-time visibility into identities we never had before. It’s redefining how we approach IAM.
VP Transformation
A global Financial Services company
Found something? Tell us
If you have found a security issue in one of our sites or in Twine itself, this is the fastest way to reach the people who will fix it. You can report anonymously, or email infosec@twinesecurity.com directly.
Our disclosure policy
What to include
The more precise the report, the faster it gets fixed. Where you can, tell us the affected URL or endpoint, the steps to reproduce the issue, and what someone could do with it.
If you need to attach a proof of concept (a screenshot, a log, a short recording), email it to infosec@twinesecurity.com instead. This form takes text only, on purpose: an upload box on a vulnerability report is its own risk.
What is in scope
Anything we run: twinesecurity.com and its subdomains, and the Twine product itself.
Out of scope: reports from automated scanners with no demonstrated impact, missing headers or cookie flags with no exploit path, denial of service, social engineering of our team or our customers, and anything that needs physical access to a device.
What we ask
Please give us a reasonable chance to fix the issue before you publish, and do not access, modify or exfiltrate anyone else’s data while you investigate. If you hit real customer data, stop and tell us.
What you get
We acknowledge every report. We will tell you what we found, what we are doing about it, and when it is fixed. We do not run a paid bounty program, and we will not threaten you with legal action for research done in good faith under this policy.
You can report anonymously: the email field is optional. We only need it if you want a reply or credit for the find.