TallyLoop AI — Security Status
Vulnerability transparency for TallyLoop AI by sp33c.tech, published in line with the EU Cyber Resilience Act (CRA). Updated with every release scan.
TallyLoop AI security scan 2026-10-28 · 2 SBOMs (Tallyloop for iPhone 1.0, Web app, API & MCP connector 1.0.0) · 2 vulnerabilities fixed · 0 open in shipped code · status: Attention
No high or critical vulnerability affects shipped code. Remaining findings are limited to build-time tooling or are documented exceptions under review.
Components
| Component | Version | Packages in SBOM | Open, shipped code | Build-time only | Exceptions | Status |
|---|---|---|---|---|---|---|
| Tallyloop for iPhone iOS App Store app |
1.0 | 0 0 runtime · 0 build-time |
0 | 0 | 0 | No known vulnerabilities |
| Web app, API & MCP connector AWS Lambda (Remix) + DynamoDB behind CloudFront (SST) |
1.0.0 | 747 228 runtime · 519 build-time |
0 | 35 | 3 | Attention |
“Runtime” packages ship with the product; “build-time” packages are only used to build or test it and never reach users. The macOS and iOS apps use Apple system frameworks only and have no third-party dependencies. Per-package details and the CycloneDX SBOMs are not published; they are available to customers, partners and market-surveillance authorities on request via the security contact below.
Reporting a vulnerability
- Security contact
- info@sp33c.tech (also in security.txt)
- Disclosure
- Report vulnerabilities by e-mail to the security contact. We acknowledge reports within 5 working days. Fixed vulnerabilities are reflected in the counts on this page once an update is available; details are shared with reporters, customers and authorities on request, not published. Please give us a reasonable time to fix before public disclosure.
- Security updates
- The web app and the MCP connector are a hosted service: security updates are deployed to tallyloop.app for every user at once. Security updates for the iPhone app are delivered through the App Store for the current release; users on older releases should update to the latest version.
How this page is produced
For every component a CycloneDX 1.5 software bill of materials (SBOM) is generated from the pinned dependency lockfile or the Xcode project. Every package and version is checked against the OSV.dev vulnerability database (GitHub Security Advisories, CVE and npm advisories), and npm components are cross-checked with npm audit. Fixed vulnerabilities are counted by comparing this scan with the first recorded one. A machine-readable summary is in status.json.
Status meaning: No known vulnerabilities — nothing found; Attention — no high or critical issue in shipped code, remaining findings are confined to build-time tooling or are documented exceptions under review; Action required — a high or critical issue affects shipped code.