Responsible Disclosure Policy
OTA Sync values the security of our users as well as the security of our systems. This Responsible Security Reporting Program allows you to alert OTA Sync of possible security vulnerabilities. We encourage the reporting of security vulnerabilities found in OTA Sync products.
This article explains how to submit your report as well as our guidelines.
Rules and regulations
- Do not attempt to read, write, or access any private data to which you have access
- Do not disclose any vulnerabilities publicly.
- Do not run any testing that would interrupt services or degrade users' abilities to utilize them.
- Do not use noisy automated scanners.
- All testing must adhere to the scopes and domains outlined below.
Report Submissions
We ask that you commit to ensuring our users' safety, so please give us time to analyze submissions through this program and fix any security vulnerabilities you may discover. Reports must be submitted to office@otasync.me with the following information
- Description of the issue
- Browser Version(if applicable)
- Scenario(if applicable)
- Steps to reproduce
- Any additional information/reference
- Proof of concept: scripts, screenshots, and compressed screen captures
- Impact of the vulnerability