Vulnerability disclosure policy
We welcome reports of security vulnerabilities in OpsSquire. This page explains what is in scope, how to report a finding and how we handle it.
Draft for review: this policy is a pre-release text that has not yet been accepted by the product owner or reviewed by a lawyer. It may change before the public beta opens.
Scope
The policy covers services operated by Blue with Green under opssquire.com: the public website, the panel and API, the documentation, tenant status pages and the OpsSquire status page.
Out of scope are services of other companies, including customers' own systems monitored by OpsSquire, and findings that require physical access, social engineering or a denial of service.
How to report
Use the vulnerability report form. The form works without JavaScript and gives you a report number. Contact details are optional.
Or send an e-mail to security@opssquire.com.
Please describe the affected address or component, the steps needed to reproduce the issue and its possible impact. Do not include other people's personal data or secrets you obtained.
Guidelines
- Test only with accounts and organizations that you own or are allowed to use.
- Do not access, change or delete data that does not belong to you; stop as soon as you reach such data.
- Do not run denial of service, load or spam tests, and do not degrade the service for others.
- Give us reasonable time to fix the issue before you disclose it publicly.
Good-faith research
We intend not to pursue claims against researchers who act in good faith and follow this policy. This statement is a draft awaiting legal review; it does not authorize anything beyond this policy and cannot bind third parties.
What happens next
We review every report and keep you informed when you leave contact details. We aim to acknowledge every report within 3 business days, counted Monday to Friday in Polish time (Europe/Warsaw). The acknowledgement confirms receipt; fixing the issue may take longer.
Machine-readable contact
Our contact details are also published in the RFC 9116 file: security.txt.