This policy covers every repository in the useobserver organization and the Observer service at use.observer.
Email security@use.observer. Please do not open a public issue, pull request, or discussion for a suspected vulnerability.
Include as much of the following as you can:
- The affected repository, release, or URL.
- A description of the issue and its impact.
- Steps to reproduce, or a proof of concept.
- Any logs, requests, or screenshots that help confirm it.
- How you would like to be credited, if at all.
We read every report and follow up by email. Please give us a reasonable chance to fix the issue before disclosing it publicly.
- Only test against accounts and data you own.
- Do not degrade the service for other users, and do not run denial of service or automated high-volume scans.
- Do not access, modify, or keep data that is not yours. If you reach someone else's data by accident, stop and include that in your report.