Responsible Disclosure

How to report a vulnerability

Email [email protected] with the subject “Security vulnerability report.” Include the affected URL or service, the observed behaviour, reproducible steps, potential impact, and any relevant screenshots or proof-of-concept details. Please do not include personal information obtained from others.

Good-faith research

Use only accounts and data you own or are authorized to test. Stop testing and report immediately if you encounter personal, confidential, or operational information. Make a reasonable effort to avoid privacy violations, service disruption, data destruction, and degradation of user experience.

Do not

• Use denial-of-service, destructive, or resource-exhaustion testing.
• Use social engineering, phishing, physical intrusion, or attacks against staff or partners.
• Access, alter, retain, or disclose data beyond what is necessary to demonstrate the issue.
• Publicly disclose an unresolved issue before we have had a reasonable opportunity to investigate and address it.

What you can expect

We will make a reasonable effort to acknowledge credible reports, investigate them, keep the reporter informed when practical, and coordinate disclosure where appropriate. Response and remediation timing depends on severity, complexity, and affected systems.

Safe-harbour intent

When research follows this policy, is lawful, and is conducted in good faith, One Bridge Tec will not seek legal action solely because of that research. This statement does not authorize testing of third-party systems and does not waive rights relating to harmful or unlawful conduct.

Rewards

We do not currently operate a paid bug-bounty program. Submission of a report does not create a right to compensation.