Report a vulnerability
Email security@ossfin.com. Please include enough detail to reproduce the issue — the affected URL or endpoint, the steps you took, and what you observed. If you can, tell us what an attacker could do with it.
We aim to acknowledge every report within 3 business days and to tell you what we intend to do about it within 10 business days. Remediation timelines follow the severity SLAs in our vulnerability management process: critical and high-severity issues are prioritised over everything else.
OssFin is a small team. We would rather hear about a problem imperfectly reported than not hear about it, so please do not wait until you have a polished writeup.
Safe harbour
If you make a good-faith effort to comply with this policy during your research, we will consider that research authorised, we will work with you to understand and resolve the issue quickly, and we will not pursue or support legal action against you.
If a third party brings legal action against you for research conducted in good faith under this policy, we will make it known that your actions were authorised.
Ground rules
- Use your own account and your own data. Do not access, modify or retain data belonging to anyone else. If you encounter someone else's personal or financial information, stop, do not save it, and tell us immediately.
- No denial of service, no load or stress testing, and no spam.
- No social engineering of our staff, our users, or our vendors, and no physical attacks.
- Do not use automated scanners against production at a rate that would degrade service for real users.
- Give us reasonable time to fix an issue before disclosing it publicly. We will keep you updated and will not ask you to stay quiet indefinitely.
In scope
ossfin.comandwww.ossfin.com- The OssFin API
Out of scope: our third-party providers — including Plaid, Stripe, Google, Railway, Vercel and Anthropic. Please report issues in their systems directly to them under their own disclosure programmes. Also out of scope: findings from automated scanners with no demonstrated impact, missing security headers with no exploitable consequence, and reports that amount to a difference of configuration opinion.
Rewards
OssFin does not currently operate a paid bug bounty. We are a one-person company and we would rather be straightforward about that than advertise a bounty we cannot reliably pay. We are glad to publicly credit researchers who report valid issues, if they would like that.
This is a vulnerability disclosure policy, not a bounty programme. The difference is the money, not the welcome — reports are genuinely wanted.
Machine-readable contact
/.well-known/security.txt (RFC 9116)