Vulnerability Disclosure Policy

We want to hear about any security weakness in Omne. This policy says what you may test, how to report what you find, and what we promise in return.

Scope

In scope:

• omne.so, Omne's website
• app.omne.so, the Omne app and its sign-in
• the API, at app.omne.so/api
• cdn.omne.so, where Omne's files and pictures are served

Out of scope:

• Services run by other companies, such as our subprocessors and the platforms you connect. Report those to the company itself.
• Denial of service.
• Social engineering of our team or our users, and spam.
• Physical attacks on offices, people or data centres.

Rules

• Test only with your own accounts and workspaces, or ones whose owner has agreed.
• Never reach, change or delete other people's data. If you come across any by accident, stop, keep none of it, and tell us.
• Do not slow Omne down for anyone else: no load tests and no high-volume automated scanning.
• Give us a reasonable time to fix an issue before you tell anyone else about it.
• Follow the law.

How to report

Email support@omne.so with "Security" in the subject. Send only as much data as the report needs.

What to include

• what you found and where
• the steps to reproduce it
• what an attacker could do with it
• your name or handle, if you would like to be thanked

Response times

We confirm that your report reached us, keep you told while we work on it, and tell you when it is fixed. We aim to fix critical issues within 7 days and high ones within 30 days.

Safe harbour

If you follow this policy in good faith, we will not take legal action against you for the research it covers, and we will not ask anyone else to.

Thanks

Omne does not run a paid bug bounty. If you would like to be thanked by name for a report, say so in it.

Contact

support@omne.so, with "Security" in the subject.