Vulnerability disclosure

How to report

Send the report to security@opendeco.net. Work through the following in the message.

1. Name the affected service, hostname, endpoint, file or commit.
2. State what the issue is and what an attacker gains from it.
3. Give reproduction steps precise enough to follow, including any request or payload used.
4. State the impact you assess and any precondition the attack depends on.
5. Say whether any third party is affected.
6. Say whether you want public credit for the finding.

Do not open a public issue or pull request for a security report, and do not publish details before a disclosure date is agreed.

Scope

OpenDeco application code and OpenDeco-controlled production hostnames are in scope, together with this repository, its build workflows and its released artifacts.

Infrastructure operated by a hosting, identity, domain, source-control or email provider is out of scope here and should be reported to that provider. Tell OpenDeco as well if OpenDeco data is affected.

Testing boundaries

• Use only accounts and data you own or have explicit permission to test.
• Do not delete, corrupt, overwrite, encrypt or retain data.
• Do not modify benchmark results, dataset records, release artifacts or published content.
• Do not access another person's data, credentials or private research records.
• Do not run denial-of-service, resource-exhaustion, phishing or social-engineering tests.
• Stop once a finding is proved. Do not pivot further and do not leave persistent access behind.

Sensitive data

If you encounter personal data, restricted research data or a credential, stop at the point that proves the finding. Take no more than the minimum needed, describe what was accessed in the private report, and delete your copies once the finding is confirmed.

Authorisation for intrusive testing

Request written authorisation from OpenDeco before testing that could affect availability, accounts or data, and keep to the boundaries above once it is given. The reporting address stays open without authorisation for anything found through ordinary use of the published site or through reading published source.

What to expect

OpenDeco assesses whether the report reproduces, judges impact, coordinates the fix and gives factual updates where contact details are available. The following are response targets and not a service level.

Acknowledgement

Within 5 working days of the report.

Initial assessment

Within 10 working days of the report.

Updates while work continues

At least every 14 days.

Coordinated disclosure

By agreement, and 90 days from the report where nothing else is agreed.

A report showing an actively exploited issue that affects published research data or the control plane is handled ahead of that schedule.

Credit and payment

Reporter credit is offered to anyone who wants it. Tell OpenDeco the name and any link to use, or say that you prefer to stay anonymous. OpenDeco does not run a bug bounty and does not pay for reports.

Security contact file

The machine-readable security contact file carries the reporting address, the link to this policy, the preferred language and an expiry date.

• Open security.txt