Security.

Email security@howdytarx.com with a description, the affected surface (web app, TARX_OS, CLI, API, or a connected service), reproduction steps, and the impact you observed.

Do not include passwords, session tokens, pairing credentials, private conversation content, or another person's data. A minimal reproduction is more useful than a full data dump.

The TARX web app, the TARX_OS desktop runtime, the CLI, TARX APIs, authentication and device pairing, and the public tarx.com surface.

Issues in a third-party service should be reported to that service. If a TARX integration is the bridge, tell us so we can coordinate.

Do not access, modify, or retain another person's account, conversation, files, or connected services.

Do not disrupt the service, run denial-of-service tests, send spam, or use social engineering against TARX staff or users.

Give us a reasonable opportunity to investigate and fix the issue before public disclosure.

TARX is built around explicit approval before action and evidence after. Native tasks are scoped, time-bounded, and independently observed where the product supports it.

We review reports, reproduce the issue where we can, and tell you the outcome. We may ask for more detail or a safer reproduction.

We do not operate a paid bounty program unless a separate written program says so.

Security reports: security@howdytarx.com.

Company: TARXAN INC., Austin, Texas.