Vulnerability disclosure
Found a security issue? Tell us.
If you find a weakness in Offboard, we want to hear about it. This page says what is in scope, how to report, what we ask of you, and what we do next.
In scope
What this policy covers.
- offboard.co, this website.
- app.offboard.co, the Offboard app.
- api.offboard.co, the service the app uses for its data.
Anything not on this list is out of scope.
- The steps to reproduce the issue.
- The URL or the part of Offboard that is affected.
- The impact: what someone could do with it.
- How we can contact you.
What we ask of you
Test with care.
- Do not access more data than you need to show the issue.
- Do not disrupt the service. No denial-of-service testing.
- Do not use social engineering or phishing against our staff or members.
- Give us reasonable time to fix the issue before you make it public.
What we do
What happens after you report.
- We acknowledge your report within 3 business days.
- We send you a first assessment within 10 business days.
- We tell you when the issue is fixed.
Rewards and good faith
No bug bounty. Clear rules instead.
No bug bounty
We do not pay rewards for reports.