Vulnerability reporting
How to report a vulnerability in the Opfyx Platform.
We appreciate reports of suspected vulnerabilities in any part of the Opfyx Platform. We don't currently operate a public bug bounty program, or offer monetary rewards for vulnerability reports. However, individuals may be acknowledged in product release notes as appropriate.
Out of scope
Please avoid reporting the following:
- Non-exploitable vulnerabilities or that our services are configured in a manner that you believe could be improved e.g. missing HTTP security headers or sub-optimal email related configuration (SPF, DKIM, DMARC, etc).
- TLS configuration weaknesses, for example weak cipher suite support or the presence of TLS 1.0 support.
Submitting a report
If you believe you have discovered a vulnerability, please report it to: security@opfyx.com.
To help us evaluate your report as quickly as possible please include:
- Date and time you first made the discovery
- URL(s)/IP(s) where you found the issue
- The steps to reproduce or a proof-of-concept code
- Any relevant tools used (including the version) and the output
We take all vulnerability reports very seriously and aim to quickly respond and verify the vulnerability before taking action to address it. After an initial reply to acknowledge the receipt of your disclosure, we will update you periodically with our progress and remediation status.
Email Encryption
You can use the PGP key, ID
0xBFC45421D0F329C0 with fingerprint
0539 7C3C F406 5DE6 D480 D126 BFC4 5421 D0F3 29C0 to
encrypt email to security@opfyx.com.