Security owner: Marques Jones, founder (security@tenantscout.ai). There is no separate security team; the owner is the incident commander.
Report a vulnerability: email security@tenantscout.ai. A machine-readable version of this policy is at /.well-known/security.txt. We acknowledge within 2 business days, and give a remediation target by severity within 5 business days. We will credit you if you want it. Do not test against other customers' data — use your own account.
Scope: tenantscout.ai and its subdomains, and the APIs they serve. Social engineering, physical security, and denial-of-service testing are out of scope.
Safe harbor: good-faith research that respects the above will not be pursued legally.