Responsible disclosure

How to report

Email security@ofcboard.com with as much detail as you can. Please don't report a vulnerability in a public issue, on social media or anywhere else in public: tell us first, and give us the time to fix it.

A good report contains:

• the address (URL) or the part of the app it's about;
• what kind of vulnerability it is, and what an attacker could do with it;
• the steps to reproduce it;
• a proof of concept, if you have one, and screenshots if they help;
• the name you'd like to be credited under, or that you'd rather stay anonymous.

Not about security? Questions about your account or your data go to info@ofcboard.com.

What you can expect

• Within 3 business days An answer from a real person. If we need more information, we ask for it; if we think your report is out of scope, we say so and explain why.
• Within 10 business days Triage: we confirm the problem, agree with you on how serious it is, and tell you when we expect to fix it. You hear from us along the way, not just at the end.
• Disclosure Once the fix is out, we're happy to agree with you on when the problem goes public. Ninety days is our default: sooner where we can, longer only where a fix needs it.
• Credit If you want it, we name you when we write about the fix. Without your permission you stay anonymous: that is the default.
• No bug bounty OFC Board doesn't pay for reports, however good they are. What we offer is a quick fix and, if you want it, credit.

Safe harbor

Research in good faith is welcome. If you act in good faith, follow the rules on this page and give us a reasonable chance to fix the problem before it goes public, we won't take legal action against you. If someone else brings a claim against you over research you did in line with this policy, we'll make it publicly known that you followed it.

Rules for testing

• Use your own accounts and groups. Never look at, change or delete other players' data.
• Stop as soon as you see someone else's data, and report it to us straight away. Don't keep or share any of it.
• No automated mass sign-ups: create the few accounts and groups you need by hand.
• Go no further than you need to show the problem.

In scope

• ofcboard.com and www.ofcboard.com
• The app there, with its accounts, groups, scoreboard and license payments

Out of scope

Please leave these alone: they fall outside this policy, and we can't act on reports about them.

• Stripe's own checkout pages and receipts: report those to Stripe;
• the hosting platform (Fly.io) and our mail provider themselves;
• denial of service, and load or volume testing;
• social engineering, of us or of players;
• physical attacks;
• scanner output without a working finding;
• missing headers without a real impact;
• anything that needs a victim's unlocked device;
• spam.

This policy is also published in machine-readable form, following RFC 9116, at /.well-known/security.txt.