Responsible Disclosure
Last updated: October 5, 2026
At Turs Technologies LLC ("Turs") we take the security of travelers, hosts and their data seriously. If you have found a vulnerability in our platform, please report it to us privately following this policy before disclosing it publicly.
1. Scope
- In scope: www.turslatam.com, portal.turslatam.com, the APIs served under those domains, and the Turs mobile app (iOS and Android).
- Out of scope: the infrastructure of our providers (Stripe, Supabase, Vercel, Google, Meta, Resend). Findings in those services should be reported directly to each provider.
2. How to report
Email info@turslatam.com in English or Spanish. Include: the affected URL or screen, steps to reproduce, the impact you observed and, where relevant, screenshots or a minimal proof of concept.
3. Rules of engagement
- Do not access, modify or download other people's data beyond the minimum needed to demonstrate the issue; if you do so by accident, stop and tell us.
- Do not perform denial-of-service attacks, mass messaging, brute force against other users' accounts, or social engineering against our team, hosts or travelers.
- Use only test accounts you own and do not complete real payments to demonstrate a finding.
- Do not publish or share the finding with third parties until we have fixed it or 90 days after your report, whichever comes first.
4. What you can expect from us
- We will acknowledge your report within 5 business days.
- We will keep you informed of our progress and let you know when the issue is fixed.
- If you wish, we will publicly credit your contribution once the issue is resolved.
- We do not currently run a paid bug bounty program.
5. Good-faith research
If you research and report in accordance with this policy, we will consider your activity authorized and in good faith, and we will not pursue legal action against you for it. This page complements our Terms of Service and Privacy Policy.