Security matters across Project Zero, developer credentials, the Tessen Gateway and Node.

Please do not open a public GitHub issue for a security vulnerability.

Report it privately to hello@tessen.ai.

Include, where possible:

• affected Tessen surface;
• concise description;
• reproduction steps;
• expected and observed behavior;
• potential impact;
• relevant logs or screenshots with secrets removed.

Do not include live API keys, session cookies, passwords, private keys or other credentials.

Project Zero is a pre-launch developer program. Availability, supported clients and security boundaries will be updated as the preview is certified.

The absence of a documented public interface does not authorize testing against private or undisclosed Tessen infrastructure.

This policy covers vulnerabilities in Tessen-controlled software and services. Third-party vulnerabilities should normally be reported upstream unless the issue is specifically caused by Tessen's integration.

Thank you for reporting security issues responsibly.