Found a security issue? Tell us.
If you find a weakness in Offboard, we want to hear about it. This page says what is in scope, how to report, what we ask of you, and what we do next.
This policy is issued by Offboard Inc., a Delaware corporation.Last updated:
What this policy covers.
- offboard.co, this website.
- app.offboard.co, the Offboard app.
- api.offboard.co, the service the app uses for its data.
This policy covers Offboard's applications and configurations at these exact hostnames. Other hostnames and systems are out of scope unless we expressly add them to this policy.
Our providers' infrastructure, other customers' systems, and third-party services are not in scope. This includes the underlying services operated by Supabase, Vercel, OpenAI, Google, Stripe, and our other providers. A listed hostname does not authorize testing everything connected to it. Do not follow a vulnerability into another party's systems or accounts.
If a test requires access outside this scope, stop and email security@offboard.co before proceeding. Silence is not permission.
- The steps to reproduce the issue.
- The URL or the part of Offboard that is affected.
- The impact: what someone could do with it.
- How we can contact you.
Include the date and time of testing, with the time zone, and identify any test accounts you used. Redact private information and secrets from examples. If sensitive evidence is necessary, ask us how to transfer it securely before sending it.
Test with care.
- Test to identify and report security weaknesses. Take reasonable steps to avoid harm to people, their information, and the service.
- Use accounts you control and test data you created. You may test access boundaries between your own test accounts. Do not deliberately access another person's account, private information, or connected services.
- Stop once you have enough evidence to report the issue. Do not collect additional records to demonstrate its scale.
- Do not disrupt the service. No denial-of-service or load testing, bulk scraping, password guessing, credential stuffing, or bypassing rate limits. Limited automation is allowed only within these rules.
- Do not alter or delete other people's information, install malware, leave persistent access, or use an issue to move into other systems.
- Do not use social engineering, phishing, or physical attacks against staff, members, or providers.
- Do not use exposed passwords, session credentials, or integration tokens. Do not use an Offboard issue to access someone's Gmail, Drive, Calendar, or other external account.
- Report confirmed issues promptly to security@offboard.co. Follow the personal-data and public-disclosure rules below.
An honest mistake does not by itself remove our good-faith protections if you promptly stop, report what happened, and follow the data-handling rules below. This does not expand the testing permission we grant. Deliberate harm, extortion, and knowingly continuing outside the permitted scope are not covered. Do not demand payment in exchange for withholding a report, returning or deleting data, or avoiding harm.
If you encounter personal data or secrets
Stop the affected testing immediately and notify security@offboard.co. Do not open more records, download more information, or keep testing to prove the impact.
Do not use or share the information. Do not send member documents, messages, passwords, tokens, or unredacted screenshots by email. Report the location, time, type of information exposed, and steps that led to it. We will arrange a secure way to receive additional evidence if needed.
Promptly delete any accidentally saved personal data or secrets from your own devices and tools, unless the law requires preservation. If preservation is legally required, tell us without sending the data and keep it secure for no longer than required. You may keep a redacted report that contains no other person's private information or secrets. Do not delete or change Offboard's own records.
Accidentally encountering information does not by itself remove our good-faith protections when you follow these steps.
Public disclosure
Please wait to publish vulnerability details until we confirm the issue is fixed or 90 calendar days after you first report it to security@offboard.co, whichever comes first. Tell us your planned publication date so we can coordinate.
We may request an extension and explain why. An extension requires your agreement. Publication after the applicable period does not require our approval or remove protection for covered research.
If there is active exploitation or another urgent risk, contact us immediately so we can discuss earlier disclosure. Never publish other people's private information, passwords, tokens, or other secrets.
This disclosure window does not delay notices we must give under law or contract. It does not restrict legally required disclosures or confidential reports to appropriate authorities.
What happens after you report.
- We acknowledge your report within 3 business days.
- We send you a first assessment within 10 business days.
- We tell you when the issue is fixed.
Our acknowledgment and assessment deadlines are response times, not a promise to fix every issue within a set period. We will share significant updates with you. If you do not receive an acknowledgment within 3 business days, please resend your report.
How we handle reports
We limit access to reports to people who need them to investigate, fix, or respond to the issue. We may share necessary details with affected providers, professional advisers, or a vulnerability coordinator. We may also disclose information to meet legal duties or respond to valid legal process. We cannot promise absolute confidentiality.
If an issue affects third-party software or services, we may coordinate with the relevant provider. This does not authorize testing that provider. We cannot promise its response or fix timeline.
We will publish your name or handle as credit only with your permission. Credit is optional and is not guaranteed.
No bug bounty. Clear rules instead.
No bug bounty
We do not pay rewards for reports.
Good-faith research
If you act in good faith and make a reasonable effort to follow this policy, we authorize your research within its scope and testing limits, to the extent we have authority to do so. This includes bypassing access controls on our software when needed for covered research. We will not bring legal claims against you or ask law enforcement to investigate you for that research. This includes claims under federal or state computer-access laws and the DMCA's access-control rules, 17 U.S.C. § 1201. We waive restrictions in our Terms of Service that conflict with this permission. We may disclose information as required by law or valid legal process. If a third party brings a claim about covered research, we will, at your request, provide a written statement confirming the permission we gave. We do not promise legal representation or payment of legal costs. We cannot bind other parties or public authorities. If you are unsure whether a planned test is covered, email security@offboard.co and wait for our reply before proceeding.
Participation and policy changes
Do not test where applicable U.S. sanctions or export-control laws prohibit us from authorizing your participation. A country name or nationality alone does not determine every restriction.
If you are under 18, or have not reached legal adulthood where you live, contact us before testing. Wait for our written approval and any required parent or guardian consent. You may still report an issue you have already discovered.
This policy grants permission and states our commitments for covered research. Reporting does not create an employment, agency, partnership, or paid services relationship.
We may change this policy or withdraw permission for future testing. We will date published changes. Changes do not remove protections for covered research already completed. If we directly ask you to stop testing, stop and contact us before resuming.