# Reporting a security problem in ObscuraOS.
#
# The tools run in the browser and there is no account system, so most of
# the interesting reports are client side: a way to make a tool leak the
# file it is working on, a bypass of the content security policy, a stored
# cross-site scripting path through a document name or a pasted document, or
# a flaw in how a vault is encrypted. The small server side is in scope too:
# getting the paid code or a Pro key without paying (/pro-code/,
# /api/licence, /stripe-webhook), reading another plan's seats (/api/seats),
# or making the site email somebody who did not ask. Those matter to us and
# we want them. The security page says what is in place and what is not.
#
# Write to the address below. Tell us what you did, what happened, and what
# you expected. A proof of concept helps. We will reply.
#
# We do not run a paid bounty. We will credit you by name on the security
# page if you want the credit, and we will not threaten you for looking.

Contact: mailto:security@obscuraos.com
Contact: mailto:hello@obscuraos.com
Expires: 2027-09-09T00:00:00.000Z
Preferred-Languages: en
Canonical: https://obscuraos.com/.well-known/security.txt
Policy: https://obscuraos.com/security