Responsible Disclosure

We take the security of Offsys Intel seriously. If you believe you have found a security vulnerability, we encourage you to report it responsibly.

How to report

Email security@offsysintel.com with:

• A description of the vulnerability and its potential impact
• Steps to reproduce
• Any proof-of-concept code (please do not include destructive payloads)

What to expect

• We will acknowledge your report within 2 business days
• We will provide an initial assessment within 5 business days
• We will keep you informed of progress toward a fix
• We will credit you (if you wish) when the fix is released

Scope

The following are in scope:

• offsysintel.com and its subdomains
• The Offsys Intel platform and API

Out of scope

• Social engineering or phishing of Offsys employees
• Denial-of-service attacks
• Attacks against infrastructure we do not own
• Automated scanning without prior coordination

Safe harbour

We will not take legal action against security researchers who act in good faith and follow this policy. We ask that you:

• Do not access, modify or delete data belonging to other users
• Do not publicly disclose the vulnerability before we have had reasonable time to address it
• Do not use the vulnerability for any purpose other than reporting it to us

PGP key

You may encrypt your report with our PGP public key. Download the key or copy the fingerprint below.