If you believe you have found a security vulnerability in TruckTA, please tell us. We welcome reports from customers, drivers, and independent researchers, and we will work with you to understand and fix the problem.
Email security@truckta.com with the subject “Security report.” Do not put vulnerability details in the website support chat, social media, or a public forum.
What to include
- The page, app screen, or address where the problem is.
- Clear steps to reproduce it, and what an attacker could do with it.
- Screenshots or a short video if they help.
- How we can reach you, and the name you'd like us to use if we thank you publicly.
In scope
- The TruckTA website at www.truckta.com, the TruckTA app at app.truckta.com, and the demo at demo.truckta.com.
- The TruckTA mobile app for iPhone and Android, including the Driver App.
- The TruckTA Load Importer extension for Chrome.
- TruckTA's own APIs used by them.
Out of scope
- Services run by other companies, such as Stripe, Supabase, Vercel, Google, Twilio, or a connected ELD provider. Report those to the company that runs them.
- Denial-of-service or load testing, spam, and social engineering of TruckTA staff, customers, or drivers.
- Physical attacks on offices, people, trucks, or devices.
- Reports from automated scanners with no demonstrated security impact.
Rules for good-faith research
- Use only accounts you created yourself, or an account whose owner has given you permission.
- Do not view, copy, change, or delete another company's or person's information. If you reach it by accident, stop, do not keep it, and tell us in your report.
- Do not disrupt the service or degrade it for other users.
- Give us a reasonable time to fix the problem before you share it with anyone else. We ask for 90 days, and we may agree on a different date with you.
- Follow the law.
What we do
- We confirm we received your report and keep you updated while we investigate.
- We fix confirmed problems as quickly as their risk calls for, and we tell you when the fix is live.
- If you followed this policy in good faith, we will treat your research as authorized and will not take legal action against you for it.
- We do not offer payment for reports at this time.