Security & Vulnerability Disclosure

Security matters to us. This policy explains how we protect this website and how to report a vulnerability to OdysseyDevelopments LLC. Our machine-readable contact is at /.well-known/security.txt.

How we protect the site

• TLS encryption and HSTS.
• Security headers.
• Server-side input validation.
• Rate limiting on forms.
• Least-privilege access to systems and data.
• Regular dependency updates.

No system is perfectly secure, and we make no guarantee that the site is free of flaws.

How to report

Email dev@odysseydevelopments.dev with a description of the issue, the affected URL or product, steps to reproduce, and any proof of concept. Please give us 90 days to fix the issue before you disclose it publicly. We acknowledge reports within 3 business days.

Scope

In scope: this website and our product sites.

Out of scope:

• Denial-of-service attacks.
• Volumetric or automated scanning that degrades service.
• Social engineering of our team or users.
• Physical attacks.
• Issues in third-party providers' systems.
• Spam, SPF, or DMARC best-practice reports without demonstrated impact.
• Clickjacking on pages without sensitive actions.

Safe harbor

We will not pursue legal action against good-faith research that follows this policy. To qualify, avoid privacy violations and data destruction, do not access more data than needed, and stop at a proof of concept. Do not exploit a vulnerability beyond that.

Rewards

We do not currently run a bug bounty program. We are glad to credit you if you wish.