Vulnerability disclosure

How to report

Email [email protected] with the details. Please use plain text and do not post the issue publicly until we have had a chance to fix it. Our contact details are also published in security.txt.

What to include

• What you found, and which page, endpoint or feature it affects.
• Steps to reproduce it, or a short proof of concept.
• What an attacker could do with it, in your view.
• Any logs or screenshots that help, with sensitive data removed.

What is in scope

• onscryn.com and the Onscryn dashboard and API.
• Authentication, session handling, access control between organizations, and the policy checks on clipboard, file transfer and streaming.

What is out of scope

• Denial-of-service testing, or anything that degrades the service for others.
• Social engineering of our staff or customers, and physical attacks.
• Reports that depend on access to another customer's account or data. Test only against accounts you own.
• Third-party services we use, which have their own programmes.
• Automated scanner output with no demonstrated impact.

What happens next

• We aim to acknowledge your report within three business days.
• We will tell you whether we can reproduce it, and keep you updated as we work on a fix.
• If you would like credit once it is fixed, tell us how you would like to be named.

We do not run a paid bug bounty programme at the moment.

Good-faith research

If you act in good faith, stay within scope, avoid accessing or changing data that is not yours, and give us reasonable time to fix the issue before disclosing it, we will not take legal action over your research.