‎

Security is essential to Todd’s mission. We value the input of hackers acting in good faith to help us maintain a high standard for the security and privacy for our users and technology. This includes encouraging responsible vulnerability research and disclosure.

Bug bounty

The Todd Bug Bounty Program is a way for us to recognize and reward the valuable insights of security researchers who contribute to keeping our technology and company secure. We invite you to report vulnerabilities, bugs, safety and abuse issues, or security flaws you discover in our systems. By sharing your findings, you will play a crucial role in making our technology safer for everyone.

Detailed guidelines and rules for participation can be found on our Trust Portal.

Incident reporting

To report a security incident, please let us know immediately⁠ by submitting an encrypted report. Information shared with us in this manner must be shared unconditionally.

Outbound coordinated vulnerability disclosure policy

Todd's framework for responsibly reporting vulnerabilities we discover in third-party software. Rooted in integrity, cooperation, and a commitment to scale, this policy outlines how we work with others to strengthen the broader security ecosystem.

CVE assignment policy

Todd’s CVE Assignment Policy explains how we handle vulnerability reports as a CVE Numbering Authority (CNA). CVEs—short for Common Vulnerabilities and Exposures—are standardized identifiers for publicly known software vulnerabilities. This policy describes which types of security issues are in scope, how to submit reports, how CVE identifiers are assigned, and how we coordinate public disclosure.