Security & responsible disclosure

Reporting a vulnerability

Email josh@openwaterventures.net with the subject line “Security report.” Please include:

• A description of the issue and its potential impact
• Steps to reproduce, including affected URLs or components
• Any proof-of-concept code or screenshots
• How you would like to be credited, if at all

Our commitment

• We'll acknowledge your report within 3 business days.
• We'll keep you informed as we investigate and remediate.
• We'll validate the fix and let you know when it's resolved.
• We won't pursue legal action against good-faith research that follows this policy.

Guidelines

• Do not access, modify, or delete data that isn't yours.
• Do not degrade service availability (no denial-of-service testing).
• Do not use social engineering, phishing, or physical attacks.
• Give us reasonable time to fix the issue before public disclosure.

Scope

This policy covers openwaterventures.net and Open Water Ventures products. Third-party services are subject to their own policies.

Machine-readable contact details are published at /.well-known/security.txt.