generated: '2026-09-19'
method: searched
source: https://tarx.com/security + https://docs.tarx.com/reference/contact + https://github.com/tarx-ai/tarx-cli/blob/main/SECURITY.md
security_txt: false
security_txt_probes:
- {url: https://tarx.com/.well-known/security.txt, status: 404}
- {url: https://www.tarx.com/.well-known/security.txt, status: 404}
- {url: https://mcp.tarx.com/.well-known/security.txt, status: 404}
- {url: https://docs.tarx.com/.well-known/security.txt, status: 404}
- {url: https://api.tarx.com/.well-known/security.txt, status: 530}
policy_url: https://tarx.com/security
contacts:
- address: security@howdytarx.com
  source: https://tarx.com/security ("Disclosure — Report security concerns to security@howdytarx.com.")
- address: security@tarx.com
  source: "https://docs.tarx.com/reference/contact (\"Security: security@tarx.com\")"
- channel: GitHub private vulnerability reporting
  source: https://github.com/tarx-ai/tarx-cli/blob/main/SECURITY.md ("Use GitHub's private vulnerability reporting for this repository when available.")
  scope: the public CLI, its handling of local files and processes, MCP configuration writes, update behavior, and the public health schema; "Proprietary TARX services and production infrastructure are managed outside this repository."
bug_bounty:
  program: null
  platform: null
  note: No HackerOne / Bugcrowd / Intigriti program found; no reward statement.
safe_harbor: null
pgp_key: null
expected_response: null
note: >-
  TARX publishes a disclosure channel three ways — a one-line Disclosure section on tarx.com/security,
  a security@ address on the docs contact page, and a SECURITY.md in the tarx-cli repo — but no RFC
  9116 security.txt on any host, no safe-harbor statement, no PGP key and no response-time
  commitment. The two email domains differ (howdytarx.com vs tarx.com); both are recorded verbatim.
  The tarx.com/security page's stated posture: runtime services bind to 127.0.0.1 by default,
  "Approval before action. Evidence after."