Vulnerability Disclosure Policy

1. Our commitment

We take the security of OneBob seriously. If you believe you have found a security vulnerability in any of our systems, please report it to us as described below so we can fix it as quickly as possible. This policy is the human-readable counterpart to our machine-readable security.txt file at /.well-known/security.txt (RFC 9116).

3. Scope

The following are in scope for this policy:

• The onebob.io marketing website and all application pages served from the same domain.
• The public booking endpoints (/book/{user}/{event}) and file-drop links.
• The OAuth callback endpoints for Microsoft 365 and Google Workspace integrations.
• The Stripe webhook and customer portal redirect handlers.

The following are out of scope:

• Findings that require physical access to a user device or social engineering of staff or customers.
• Denial-of-service tests against production. Volumetric or rate-driven tests need prior written agreement.
• Reports against third-party services we depend on (Stripe, Cloudflare, Hetzner). Please report those to the vendor directly.
• Reports that consist only of automated scanner output without a reproducer.

4. Rules of engagement

When testing, please:

• Only interact with accounts you own, or accounts on a test tenant you have created yourself.
• Do not access, modify, exfiltrate, or destroy data that does not belong to you. Stop and report as soon as you have proof of access.
• Do not run automated scanners at a rate that affects availability for other tenants.
• Give us a reasonable window to investigate and remediate (90 days by default) before any public disclosure.
• If you accidentally access data that is not yours, delete your copies and tell us in the report.

5. Safe harbour

We will not pursue legal action against researchers who report vulnerabilities in good faith and comply with this policy. We consider security research that follows these rules to be authorized conduct under the German Strafgesetzbuch §202a-c and equivalent international laws, and we will work with researchers to clarify whether a planned test stays within scope if asked in advance.

6. What to expect

• We acknowledge new reports within two business days.
• We aim to provide an initial assessment (severity, planned remediation window) within five business days.
• We coordinate disclosure timing with the reporter and credit them in release notes unless they prefer otherwise.
• We do not currently run a paid bug bounty programme. We are happy to acknowledge researchers publicly with permission.

7. Machine-readable evidence

Our security.txt file is published at https://onebob.io/.well-known/security.txt per RFC 9116, and lists the canonical contact mailbox, this policy URL, the expiry date of the file itself, and the preferred languages. The Composer and npm dependency manifests are audited on every merge request and on a daily schedule via our CI pipeline; high-severity advisories block deployment.