Reporting a vulnerability

1. How to report

If you believe you have found a security vulnerability in orboto.io, the Customer Portal at account.orboto.io, an orboto Cloud workspace on *.orbo.to or another service orboto operates for them, write to [email protected]. Please include the affected URL or component, the steps to reproduce, the impact you observed and how we can reach you.

2. What we ask

• Test only against your own account and workspace. Do not access, change or delete data that is not yours.
• No denial-of-service, spam, social engineering or physical attacks.
• Give us reasonable time to fix the issue before you disclose it.

3. What we do

• We confirm receipt within 5 business days and keep you informed until the issue is resolved.
• We do not take legal action against good-faith research that follows this policy.
• If personal data was affected, we notify the competent supervisory authority and affected customers as the GDPR requires.

4. Self-hosted instances

Self-hosted orboto instances are operated by their owners. Report issues in their deployment to them, and issues in the orboto software itself to us.