Security

Vulnerability Disclosure Policy

If you have found a security issue in O3 Security, we want to hear about it. We respond, we coordinate, and we do not surprise researchers with legal threats.

Last updated 2026-10-31. Machine-readable version: security.txt.

How to report

Email [email protected] or use the contact form. If the issue involves customer data, put [URGENT] in the subject line.

Include what you found, where, the steps to reproduce it and the impact you believe it has. A proof of concept helps; it does not need to be polished.

What we commit to

An on-call security engineer responds within one business day.
Critical issues are acknowledged within four hours.
A default coordination window of 90 days from acknowledgement before public disclosure, which we will agree with you if a fix needs longer or ships sooner.
Public credit on our blog and security advisories, with your consent.
No legal action against researchers who act in good faith under this policy.

In scope

o3.security and its subdomains, including the web app and the hosted MCP and API endpoints.
O3 products, extensions and self-hosted distributions.

Please do not

Access, change or delete data that is not yours, beyond the minimum needed to show the issue.
Run denial-of-service or volumetric tests, or anything that degrades the service for others.
Use social engineering or physical attacks against O3 staff or offices.
Disclose the issue publicly before the coordination window ends or we agree a date with you.