Vulnerability disclosure policy
If you think you've found a security problem in Octopus Prime, we want to hear about it. Here's how to tell us and how to test without putting anyone's data at risk.
How to report
Email support@octopusprimeai.com with "Security" in the subject. Please include:
- what you found and where (the page, address or app screen);
- the steps to reproduce it;
- what an attacker could do with it;
- how we can reach you if we have questions.
We read every report, and we'll tell you when the problem is fixed.
What's covered
- octopusprimeai.com and app.octopusprimeai.com
- api.octopusprimeai.com
- the Octopus Prime iPhone app, Mac app and the add-ons you install on your computers
Not covered: other software on your computers and how you set those computers up, the services we use (report those to their makers), and findings that need a stolen device or an account someone handed over.
Testing in good faith
- Use only accounts and organizations you own or have permission to test.
- Don't read, change or delete other people's data. If you reach some by accident, stop, don't keep it, and tell us.
- Don't slow the service down for others: no denial-of-service, spam or automated flooding.
- No social engineering, phishing or physical attempts against our team or customers.
- Give us a reasonable time to fix the problem before you share it with anyone else.
If you follow these rules, we'll treat your research as done in good faith, we won't pursue legal action against you for it, and we'll work with you to understand and fix the problem.
More
How we look after data: Trust and Security. Contact details for researchers: security.txt. Everything else: support@octopusprimeai.com.
