This policy covers every repository in the useobserver organization and the Observer service at use.observer.

Email security@use.observer. Please do not open a public issue, pull request, or discussion for a suspected vulnerability.

Include as much of the following as you can:

• The affected repository, release, or URL.
• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• Any logs, requests, or screenshots that help confirm it.
• How you would like to be credited, if at all.

We read every report and follow up by email. Please give us a reasonable chance to fix the issue before disclosing it publicly.

• Only test against accounts and data you own.
• Do not degrade the service for other users, and do not run denial of service or automated high-volume scans.
• Do not access, modify, or keep data that is not yours. If you reach someone else's data by accident, stop and include that in your report.