Security
Report a vulnerability responsibly.
If you believe you found a security issue in TagVomo, email [email protected]. We will read every report. Last reviewed 30 September 2026.
What to include
- A clear description and the page or API involved.
- Steps to reproduce, with screenshots or requests where helpful.
- The impact you believe it has.
- Your contact details if you want a reply.
In scope
- tagvomo.com pages and the /api endpoints they use.
- Scan, owner, order and portal flows.
- Issues that expose owner contact data, health data or another user’s data.
Out of scope
- Denial-of-service or volumetric testing.
- Social engineering or physical attacks on staff or partners.
- Third-party services (payment, messaging, hosting) - report those to the provider.
- Reports that only show missing best-practice headers with no demonstrated impact.
Safe testing rules
- Do not access, modify or keep other users’ data. Stop and report as soon as you see it.
- Use your own tags and accounts. Do not send messages to real owners.
- Do not run automated scanners at high volume.
- Give us reasonable time to fix before publishing details.
We acknowledge reports and aim to reply promptly, but we do not currently run a paid bug bounty and cannot promise fixed timelines or rewards. Good-faith research that follows these rules will not be pursued.