Security

Report vulnerabilities to security@outemit.dev. Do not file public GitHub issues with exploit details. There is no published bug bounty.

Disclosure SLA

• Acknowledgement of a valid report within 3 business days of receipt at security@outemit.dev.
• Status update (fix, mitigation, or declined-with-reason) within 14 days of acknowledgement.
• Coordinated disclosure: we ask 90 days after acknowledgement before public write-ups, unless we agree otherwise.

This SLA is an operational target for the mailbox we publish. It is not a contractual commitment and does not imply that the mailbox is staffed 24/7.

Abuse

Report phishing, spam, or account abuse to the same address with subject line Abuse:. Include URLs, timestamps, and tenant IDs when you have them. Do not attach payloads that contain secrets.

Scope

• outemit.dev, staging.outemit.dev, app.outemit.dev
• API authentication, tenant isolation, SSRF on destination URLs, signing secrets

Out of scope until GA

We have not completed an independent penetration test. Do not treat this page as a compliance claim (SOC 2, GDPR adequacy, or similar).

security.txt · status