Skip to content
Create workspace

Security

Last updated:

How we protect your workspace

  • All traffic to the Tikketty app uses HTTPS.
  • Passwords are stored only as salted scrypt hashes. Session cookies are HttpOnly, Secure and SameSite.
  • API tokens and widget tokens are stored as hashes, scoped and checked against current membership on every request.
  • Credentials for connected integrations are encrypted with AES-256-GCM.
  • Uploaded files are stored privately. Downloads are authorized first and use short-lived signed links.
  • Workspace roles, project access, client visibility and internal comments keep content limited to the right people.
  • A strict Content Security Policy, rate limiting and origin checks help protect against common web attacks.
  • A security activity log records account and workspace changes without storing issue text, passwords or tokens.
  • Payments are handled by Stripe. Card numbers never reach our servers.

Report a vulnerability

If you think you have found a security issue in Tikketty, email security@tikketty.com with a description, the steps to reproduce it and its impact. Please do not include other people’s data. We will acknowledge your report, keep you updated, and let you know when it is fixed.

Our security.txt file lists the same contact.

Guidelines for security research

  • Only test against accounts and workspaces you own or have permission to use.
  • Do not access, change or delete other people’s data. Stop and report as soon as you see data that is not yours.
  • Do not run denial of service, spam, social engineering or physical attacks, or automated scanning that degrades the Service.
  • Give us reasonable time to fix an issue before you disclose it publicly.

If you follow these guidelines in good faith, we will not pursue legal action against you for your research. We do not currently run a paid bug bounty program.

Scope

In scope: tikketty.com, the Tikketty app and API, the embeddable widget, our browser extensions and our WordPress plugin. Out of scope: third-party services we integrate with (report those to the provider) and websites where customers install the widget.