Security
Report vulnerabilities to security@outemit.dev. Do not file public GitHub issues with exploit details. There is no published bug bounty.
Disclosure SLA
- Acknowledgement of a valid report within 3 business days of receipt at security@outemit.dev.
- Status update (fix, mitigation, or declined-with-reason) within 14 days of acknowledgement.
- Coordinated disclosure: we ask 90 days after acknowledgement before public write-ups, unless we agree otherwise.
This SLA is an operational target for the mailbox we publish. It is not a contractual commitment and does not imply that the mailbox is staffed 24/7.
Abuse
Report phishing, spam, or account abuse to the same address with subject line Abuse:. Include URLs, timestamps, and tenant IDs when you have them. Do not attach payloads that contain secrets.
Scope
- outemit.dev, staging.outemit.dev, app.outemit.dev
- API authentication, tenant isolation, SSRF on destination URLs, signing secrets
Out of scope until GA
We have not completed an independent penetration test. Do not treat this page as a compliance claim (SOC 2, GDPR adequacy, or similar).