Report a Security Issue
If you believe you have found a security vulnerability in OpSemble, or you are aware of a security incident affecting OpSemble or its customers' data, we want to hear from you — whether you are a customer, a security researcher, or anyone else.
How to report
Email security@opsemble.co.uk. Please include, where you can:
- a description of the issue and where you found it (URL or area of the product);
- steps to reproduce it, or proof-of-concept detail;
- what you believe the impact is;
- a way to reach you for follow-up questions.
What we commit to
- We will acknowledge your report within 2 working days.
- We will investigate promptly, keep you informed of progress, and tell you when the issue is resolved.
- If an issue affects the security of personal or customer data, we follow our incident process: affected customers are informed, and where required we notify the Information Commissioner's Office and HM Revenue & Customs within 72 hours of becoming aware.
Good-faith research
We will not take legal action against anyone who, in good faith: reports an issue promptly, avoids accessing or modifying data that is not theirs beyond what is necessary to demonstrate the issue, does not degrade the service for others, and gives us reasonable time to fix the issue before disclosing it publicly. Please do not run automated scanning against the production service without agreeing it with us first, and never test using another customer's account or data.
Out of scope
- Denial-of-service or volumetric testing.
- Social engineering of our staff or customers, and physical attacks.
- Reports about third-party services we use, without an OpSemble-specific impact.
We do not currently operate a paid bug bounty programme, but we are happy to credit reporters who would like to be named once an issue is fixed.