Report a vulnerability
If you find a security problem in Outpost, report it privately by email so it can be fixed before anyone else learns of it. This page says where to send the report, what to put in it, and what happens after you send it. It is for security researchers, and for customers whose own testing found something.
Before you begin
Section titled “Before you begin”- Do not open a GitLab issue, a merge request, or a public discussion about a security problem. This documentation’s repository and the site it builds are public, and so is everything filed against them.
- Test only against your own data and your own Outpost. Do not test against another customer’s Outpost.
- You do not need to encrypt the report, and you do not need an account anywhere to send one.
Send the report
Section titled “Send the report”- Write the report in English, with as much of this as you have:
- What the problem is, in one or two sentences.
- The component and version: Depot, the agent, the tray app, Remote Outpost, Outpost Sync, the Outpost service, or this documentation site.
- The steps to reproduce it, or a proof of concept.
- What an attacker gets out of it.
- Whether anyone else knows, and any disclosure deadline you are working to.
- Email it to [email protected].
What happens next
Section titled “What happens next”| When | What happens |
|---|---|
| Within 3 working days | Outpost acknowledges the report and says who is handling it. |
| Within 10 working days | Outpost confirms whether it can reproduce the problem and gives an initial severity. |
| Then | Outpost agrees on a fix and a disclosure date with you. |
Outpost tells you when the fix ships and in which version, and credits you in the release note unless you ask not to be credited.
Outpost does not run a paid bug bounty.
In scope:
- Depot, the agent, the tray app, Remote Outpost, Outpost Sync, and the Outpost service itself, at any supported version.
- This documentation site, its server, and the build pipeline that produces them.
Out of scope:
- Reports produced by a scanner with nothing behind them, including missing headers on a page that carries no data, and TLS configuration warnings that do not lead anywhere.
- Denial of service by volume, and anything that needs physical access to an endpoint that is already compromised.
- Social engineering of Outpost staff or of a customer.
- Testing against a customer’s production Outpost. Test against your own.
Safe harbor
Section titled “Safe harbor”If you follow this page, keep to your own data and the scope above, avoid degrading anyone’s service, and give Outpost a reasonable chance to fix the problem before you publish, Outpost treats your research as authorized and will not pursue a claim against you.
Machine-readable policy
Section titled “Machine-readable policy”The same contact details are published at /.well-known/security.txt.
Related
Section titled “Related”Content is licensed CC BY 4.0. Code samples are MIT. Outpost and the Outpost mark are trademarks of Outpost Business Solutions, PBC and are not covered by either license.