Security

Report a vulnerability

Email security@tealbrick.com. A person reads every report.

If you cannot use email, write to Polygonface s.r.o., Sládkovičova 60, 974 05 Banská Bystrica, Slovakia. Our machine-readable contact file is at /.well-known/security.txt.

This policy covers the Tealbrick products: the Portal (portal.tealbrick.com), the workspace bridge, the tealbrick CLI and its installer, the desktop app and the Tealbrick mini apps. It also covers this website.

What to include

• The product and its version.
• What you found, the steps to reproduce it, and what an attacker could do with it.
• Any proof-of-concept code, logs or screenshots that help us confirm it.
• How we can reach you, and whether you want to be named when we publish the fix.

Please send reports in English or Slovak.

What happens next

1. We confirm that we received your report within [3 working days — to confirm].
2. We assess it and send you our plan, with a severity and an expected fix date, within [10 working days — to confirm].
3. We keep you informed while we fix it.
4. We release the fix free of charge, then publish a security advisory that describes the problem, the affected versions, the impact and how to update. We agree the publication date with you.

Good-faith research

[Safe-harbour wording for security researchers under Slovak law — to confirm (legal review)]

While you research, do not access, change or delete data that is not yours, do not disrupt the service for others, do not use social engineering or physical attacks, and give us reasonable time to fix the problem before you publish it.

How we tell users and the authorities

If we learn that a vulnerability in one of our products is being actively exploited, or that a severe incident affects the security of one of our products, we report it as the EU Cyber Resilience Act (Article 14) requires: to SK-CERT, the national CSIRT at the Slovak National Security Authority (NBÚ), through its reporting system JISKB. We send an early warning within 24 hours, a notification within 72 hours and a final report.

We also tell the affected users without undue delay, by email to the workspace owners and with a notice in the Portal, and we say what they should do to protect themselves.

Support periods

Each Major Version of each product gets security updates for at least 5 years from its first release. Security updates are free of charge, whether or not you hold a licence (Terms of Service, section 13).

Releases are signed. The installer and tealbrick self-update check the signed release index and the checksums of every package before they install it, and the Portal deploys only releases that are recorded in its signed release registry.

Software bill of materials

To be published. We will publish a machine-readable software bill of materials (SBOM) for each release and link it here.