# OleaDesk — how to report a security problem
#
# If you have found something, tell us before you tell anyone else and we will work with
# you. We are a small team and we answer our own mail; you will get a human.
#
# Format: RFC 9116. https://www.rfc-editor.org/rfc/rfc9116

Contact: mailto:hello@oleadesk.com
Expires: 2027-08-13T00:00:00.000Z
Preferred-Languages: en
Canonical: https://oleadesk.com/.well-known/security.txt
Policy: https://oleadesk.com/legal

# What is most useful to us, in order:
#   1. Anything that reaches another customer's data. Buyer addresses sit behind a paywall
#      and mailboxes are stored on the customer's own machine, so both are worth probing.
#   2. Anything that lets a message be sent without the owner approving it. Nothing in this
#      product is supposed to send by itself, and a way around that is the worst bug we could
#      have.
#   3. Anything that undermines the desktop update chain — the installer is signed, and the
#      app refuses any update whose signature does not verify.
#
# Please do not run automated load or denial-of-service testing against our systems, and
# please do not access, alter or keep data belonging to anyone but yourself.