Security
How to report a security problem in Tally
Reporting a problem
E-mail: security@tally-app.dev
If you think you've found a security problem in the Tally app or on tally-app.dev, please e-mail us. Tell us what you found, how to reproduce it, and the app version (Tally's Settings > About).
Please don't send real grades, passwords, sign-in tokens or anyone's personal information. Your own test data, or Tally's Explore with Sample Data mode, is enough to show a problem.
What this page covers
- The Tally iPhone app and its widgets.
- The pages on tally-app.dev, including the page that finishes signing in.
Your school's Canvas, Instructure's systems and Apple's App Store are run by others, so please report problems with them to your school, Instructure or Apple.
What to expect
We'll acknowledge your report within 5 business days and keep you updated until it's resolved. Please give us a reasonable time to fix a problem before you make it public, and we'll agree a date with you. Tally has no server and holds no student data, so most fixes reach people as an app update through the App Store. We don't offer payment for reports.
Testing in good faith
Only test with your own Canvas account or with Explore with Sample Data, never with someone else's account or data. Don't do anything that could disrupt your school's Canvas or other people. If you follow this page in good faith, we won't take legal action against you for your research.
Our security contact is also published at /.well-known/security.txt.