Vulnerability Disclosure Policy

Last updated: July 30, 2026

Odysec welcomes good-faith security research. If you find a security issue in our systems or published tools, please report it under this policy — we take every report seriously and handle it through coordinated disclosure.

1. Scope

• odysec.org and check.odysec.org, including their API endpoints.
• The collector we publish (odysec-check.py) and our other public tools.

Out of scope: our customers' systems and assets (we cannot authorize you to test them), and third-party services (such as Cloudflare or payment providers).

2. How to report

Write to security@odysec.org, including where possible:

• The type of issue and where it lives (URL, endpoint, or tool version).
• Steps to reproduce, or a proof of concept.
• Your assessment of the impact.

We do not currently run a bug bounty program; with your consent, we are glad to credit you by name once the issue is fixed.

3. What we do with reports

• We normally acknowledge receipt within 7 business days, along with an initial assessment.
• Please do not publish details before a fix is in place; we will coordinate the disclosure timing with you.
• Report contents are used solely to assess and fix the issue, handled per our Privacy Policy.

4. Boundaries of good-faith research

We will not pursue legal action against researchers who act in good faith within these boundaries:

• Non-destructive testing against the scope listed in Section 1 only.
• Do not access, modify or delete data that is not yours; use the minimum access needed to demonstrate the issue, and delete any data obtained after reporting.
• No denial of service, brute forcing, spam, social engineering or physical intrusion.
• Report within a reasonable time of discovery, and do not disclose to third parties.

5. Our own research conduct

As a security service provider, our outbound testing follows the same standard:

• All testing is predicated on authorization — attack surface monitoring requires domain ownership verification (DNS TXT) first, and the host-check collector is run by customers themselves.
• If we discover a security issue in a third-party system during research or service delivery, we notify its operator under coordinated disclosure principles and do not publish unfixed details.

6. Contact

Security reports: security@odysec.org. The machine-readable version of this policy lives at /.well-known/security.txt, which is signed with the key below.

7. OpenPGP key

Use the following key to encrypt a report, or to verify the signature on our security.txt:

The key is also published in our Web Key Directory:

gpg --locate-external-keys security@odysec.org
curl -s https://odysec.org/.well-known/security.txt | gpg --verify