OsbornePro - Security Policy

At osbornepro.com, we take security seriously and greatly appreciate the efforts of security researchers who work to improve the safety and integrity of our systems. This policy outlines what you should do if you identify potential vulnerabilities on our platform.

Questions? Reading this security policy will help you outline what you should do when researching or reporting security issues.
If you do not agree with our policies and practices, please do not use our Services.
If you have any questions or concerns, please contact as at rosborne@osbornepro.com

NOTE: The PGP key provided is associated with rosborne@osbornepro.com but and be used for encrypting emails sent to rosborne@osbornepro.com.

Guidelines for Security Researchers

If you are searching for or reporting security issues, please follow these guidelines:

• Act in Good Faith: Ensure that your actions are aimed at improving the security of our platform, and avoid any activity that could harm our systems, users, or data.
• Do Not Exploit Vulnerabilities: If you identify a security issue, do not exploit it to access data or systems beyond what is necessary for your research.
• Limit Testing to Your Own Accounts: Avoid testing vulnerabilities on accounts or data that do not belong to you.
• Respect Privacy: Do not attempt to access, modify, or delete user data that is not your own.
• Avoid Service Disruption: Do not engage in testing that could degrade the availability of our services (e.g., denial-of-service attacks).
• Report Vulnerabilities Promptly: If you discover a security issue, report it to us immediately following the instructions below.

How to Report a Security Issue

If you identify a security vulnerability, please report it using the following steps:
NOTE: The PGP key provided is associated with rosborne@osbornepro.com but can be used for encrypting email messages sent to rosborne@osbornepro.com.

• Email your findings to rosborne@osbornepro.com.
• Include a detailed description of the issue, steps to reproduce it, and any relevant tools or scripts you used.
• If applicable, include proof-of-concept code or screenshots to demonstrate the issue.
• Optionally, encrypt your report using our public encryption key to protect sensitive information.

What to Expect

When you report a security issue, you can expect the following:

• An initial response acknowledging your report within 48 hours.
• An investigation into the reported issue. If confirmed, we will work to resolve it as quickly as possible.
• Credit (optional): If you would like to be acknowledged, we can list your name on our Acknowledgements page.

Legal Safe Harbor

We will not take legal action against researchers who:

• Follow this policy in good faith.
• Limit their testing to discovering vulnerabilities without exploiting them.

If you are unsure whether your actions comply with this policy, please contact us before proceeding.