Responsible disclosure

Found something? Tell us — safely.

If you believe you have found a security vulnerability in OLOBOLO — the site, the API, the dashboard, the badge endpoint or the open-source tooling — we want to hear about it, and we want reporting it to be safe and unbureaucratic.

How to report

Email security@olobolo.com with what you found, where, and how to reproduce it. Our machine-readable contact record is at /.well-known/security.txt(RFC 9116). Languages: English or Danish.

What we commit to

  • Acknowledgement within 72 hours. A human reply confirming receipt — not an autoresponder.
  • Severity-graded handling. Reports enter the same severity and escalation flow as our internal security findings, and we keep you informed of progress toward a fix.
  • Coordinated disclosure. We fix before we (or you) publish, and we agree on the timeline with you rather than dictating one. We will not sit on a report to avoid embarrassment — our own record-keeping makes that visible.
  • Credit, if you want it. With your consent we name and thank reporters below. There is no bounty program in this first version — we say that plainly rather than implying one.

Safe harbor

We consider security research conducted in line with this policy to be authorized access to our systems, and we will not pursue or support legal action against researchers who: act in good faith to identify and report a vulnerability; avoid privacy violations, data destruction and service degradation; access no more data than needed to demonstrate the issue; and give us a reasonable disclosure window — 90 days from your report by default, or another timeline we agree on — to remediate before public disclosure. Where third parties are involved we cannot make promises on their behalf, but to the extent the decision is within our control, we will not initiate or support action against research that follows this policy. Testing that knowingly targets customer data or attempts social engineering of our people is out of scope.

Thanks

No reports yet — this section will name the researchers who helped, with their consent.