Security
Report a security issue.
If you believe you've found a security vulnerability in Openbox, we want to hear about it. We appreciate reports made in good faith and work with reporters to fix issues quickly.
How to report
Email support@openboxlearn.com with the subject “Security report”, or use the support form and choose “Privacy or security question”. Please include:
- What you found and where: the page, feature, or address involved.
- Steps to reproduce it, and what an attacker could do with it.
- Any proof of concept, kept to the minimum needed to show the issue.
- How we can reach you, if you'd like updates or credit.
What we commit to
- We'll acknowledge your report within 3 business days.
- We'll keep you updated as we investigate and fix the issue.
- We'll credit you when the fix is released, if you'd like.
Good-faith research
If you follow this policy, we consider your research authorized, we won't pursue or support legal action against you for it, and we'll work with you to understand and resolve the issue.
- Only test against your own account or a test account you create. Never access, change, or delete another person's data.
- If you reach someone else's data by accident, stop, don't keep a copy, and tell us.
- Don't run denial-of-service tests, spam, or automated scans that degrade the service for others.
- Don't use social engineering, phishing, or physical access against our staff, customers, or providers.
- Give us a reasonable time to fix the issue before you share details publicly.
What's in scope
The Openbox application at openboxlearn.com and its organization, learner, and administrator features. Reports about third-party services we use are welcome, but those issues may need to go to that provider. We don't currently offer paid rewards.