Vulnerability Disclosure Policy

Report a Vulnerability

Open Stack Forge welcomes reports from security researchers and members of the public. If you believe you have found a vulnerability, a privacy issue, exposed data, or any other security problem affecting our systems, we want to hear about it.

This policy explains what systems are covered, what testing is authorised, how to report what you find, what we commit to in return, and how long we ask you to wait before disclosing publicly.

We would rather hear from you than read about it somewhere else. If you are unsure whether something is in scope or whether your intended testing is acceptable, contact us first and ask.

Official reporting channel

Email: security@openstackforge.ca

For urgent matters involving active exploitation or exposed customer data, you may also call +1 902-706-8753.

Please use these channels rather than social media, public issue trackers, or our general enquiry forms. Using an official channel is what allows this policy, including its safe harbour provision, to apply to your research.

Authorisation and Safe Harbour

If you make a good-faith effort to comply with this policy during your security research, we will consider your research to be authorised, and we will work with you to understand and resolve the issue quickly.

Specifically, for research conducted in accordance with this policy, we consider that research to be:

• Authorised with respect to any applicable anti-hacking or computer misuse law. We will not initiate or support legal action against you for accidental, good-faith violations of this policy.
• Authorised with respect to any applicable anti-circumvention law. We will not bring a claim against you for circumventing technological controls on our own systems.
• Exempt from any restriction in our Terms of Service or acceptable use terms that would otherwise interfere with good-faith security research. We waive those restrictions on a limited basis for that purpose.
• Lawful, useful to the overall security of the internet, and conducted in good faith.

If a third party initiates legal action against you and you have complied with this policy, we will take steps to make it known that your actions were conducted in compliance with it.

You are expected to comply with all applicable laws at all times. This safe harbour extends only to legal claims within our own control; it cannot and does not bind independent third parties, including our suppliers, our clients, or law enforcement. If at any point you are uncertain whether your research is consistent with this policy, stop and contact us before going further.

Systems in Scope

This policy applies to internet-facing assets that Open Stack Forge Limited owns and operates:

Newly launched internet-facing services that we own are included in scope automatically.

Out of Scope

Client systems are strictly out of scope

Open Stack Forge designs and operates infrastructure for client organisations. Systems belonging to our clients are not covered by this policy and you are not authorised to test them, whether or not you believe we operate them, and whether or not they appear related to us.

We cannot grant safe harbour over assets we do not own. If you believe you have identified a vulnerability in a system operated on behalf of a client, report it to us through the official channel above and stop testing immediately. We will coordinate with the asset owner.

Third-party services

We rely on third-party platforms that we do not own or control. These are out of scope and should be reported to the relevant vendor under their own disclosure programme:

• Our website hosting and CDN provider
• Our email provider
• Our third-party assessment tool used for the Software Cost and Flexibility Audit, which is served from a third-party domain
• Any third-party analytics, forms, or marketing platforms embedded in our site

If you are unsure whether an asset is ours, ask before testing.

Testing That Is Not Authorised

The following are outside this policy and are never authorised. Engaging in them removes the protection of the safe harbour above.

• Denial of service. Volumetric, stress, load, or resource-exhaustion testing of any kind against any asset.
• Social engineering. Phishing, pretexting, vishing, or smishing directed at our personnel, contractors, family members, suppliers, or clients.
• Physical testing. Open Stack Forge operates from a private residence. Do not attempt physical access, tailgating, on-site reconnaissance, dumpster diving, or any other physical or in-person testing under any circumstances.
• Accessing, modifying, or exfiltrating data beyond the minimum necessary to demonstrate a vulnerability.
• Destroying, corrupting, or degrading data, or disrupting the availability or integrity of any service.
• Persistence. Installing backdoors, implants, or maintaining access after demonstrating the issue.
• Automated scanning that generates disruptive traffic, or submitting raw, unvalidated scanner output as a report.
• Testing accounts other than your own, or those you have explicit written permission to test.

Findings We Consider Low Priority

We will read every report. The following are generally not treated as actionable in isolation, and we ask you to include a demonstrated impact if you report them:

• Missing security headers with no demonstrated exploit path
• Absence of rate limiting on endpoints that do not perform authentication or state changes
• Clickjacking on static pages with no sensitive action or state change
• Self-XSS, or issues requiring the victim to paste content into a console
• Email configuration opinions unaccompanied by a working spoofing or interception demonstration
• Vulnerabilities requiring physical access to a device, a rooted or jailbroken device, or an already-compromised browser
• Reports of publicly available business registration information, or of information we have deliberately published
• Output of TLS or CVE scanners without a demonstrated impact on our systems
• Version disclosure, banner grabbing, or directory listings with no sensitive content

What to Include in Your Report

A clear report is far quicker to act on. Where possible, please include:

• Summary — what the issue is, in one or two sentences.
• Affected asset — the exact URL, hostname, endpoint, or parameter.
• Steps to reproduce — numbered and specific enough for us to follow.
• Impact — what an attacker could actually achieve.
• Supporting evidence — request and response pairs, screenshots, or a short video. Please redact any third-party personal information.
• Your name or handle, if you would like to be credited.

Reports in English are preferred.

If you encounter personal data

If a vulnerability gives you unintended access to data, limit what you access to the minimum needed to demonstrate the issue. If you encounter personal information, health information, credentials, payment data, or client confidential information, stop testing immediately, do not save or copy it, and report to us at once. Tell us what you saw so we can assess our obligations under Canadian privacy law, including any breach notification requirements.

What You Can Expect From Us

Open Stack Forge is a small firm and we would rather publish timelines we can actually meet than impressive ones we cannot.

We also commit to:

• Work with you to understand and validate what you have reported
• Keep you informed as the issue progresses, including if we decide not to act and why
• Tell you when the issue is resolved
• Credit you publicly if you would like to be credited, and respect your wish to remain anonymous if you would not

Coordinated Disclosure

We ask that you give us 90 days from your initial report before disclosing publicly, so we have a reasonable opportunity to remediate.

If you would like to publish sooner, tell us and we will work with you on timing. If we resolve the issue before 90 days, you are welcome to publish once the fix is deployed and we have confirmed it. If we have not responded within the timeframes above, we consider it reasonable for you to escalate, and we would still prefer to hear from you first.

We will not ask you to keep a vulnerability confidential indefinitely.

Recognition

Open Stack Forge does not currently operate a paid bug bounty, and we will not offer monetary rewards. We would rather be straightforward about that than imply a payment that is not coming.

What we do offer is prompt, technically competent engagement from the team that actually runs the infrastructure, and public credit where you want it.

Governing Terms

This policy is published by Open Stack Forge Limited, a company incorporated in the Province of Nova Scotia, Canada, operating as Open Stack Forge. It is governed by the laws of the Province of Nova Scotia and the applicable laws of Canada.

This policy does not grant permission to act in any manner inconsistent with the law, and it does not authorise testing of systems belonging to anyone other than Open Stack Forge.

Where this policy conflicts with our other published terms, this policy prevails for good-faith security research conducted under it.

We may update this policy. The version and effective date are shown at the top of this page, and the version in force at the time of your research is the one that applies to it.

Machine-readable contact details:
/.well-known/security.txt