Vulnerability disclosure policy

We want to hear about security weaknesses in OSBase. If you think you have found one, please tell us so we can fix it.

Last updated: 5 October 2026

How to report

E-mail security@osbase.io. Please include:

the page, address or feature affected;
the steps to reproduce it;
what an attacker could do with it;
how we can contact you.

Include only the minimum personal data needed to show the problem. If you need to send something sensitive, say so in your first e-mail and we will agree a secure way to receive it.

What to expect from us

We will acknowledge your report within 3 business days.
We will keep you informed while we investigate and tell you when the issue is fixed.
We ask you to give us a reasonable time to fix it before you disclose it publicly, and we will agree the timing with you.

Scope

In scope: osbase.io and its subdomains, including organisation workspaces (your-organisation.osbase.io) and the Mailroom, Print Portal, Signage and supplier-portal services reached through them.

Out of scope:

services run by third parties, including our sub-processors — report those to the provider;
denial-of-service or load testing;
social engineering or phishing of our staff or customers, and physical attacks;
reports from automated scanners without a demonstrated, exploitable impact;
missing best-practice settings (headers, cookie flags, e-mail authentication records) without a demonstrated exploit;
issues that need a compromised device or a rooted or jail-broken phone.

Testing rules

Test only against an organisation you own. You can create a free workspace for this.
Never access, change or delete another organisation's data. If you come across it, stop, do not keep a copy, and tell us.
Do not degrade the service for anyone else, and do not run high-volume automated scans.
Keep the details confidential until we have agreed disclosure with you.
Act within the law.

Rewards

We do not run a paid bug bounty and do not pay for reports. We are grateful for every report.