Security Policy
We take the security of opentab and its users seriously. If you find a vulnerability, please tell us privately so we can fix it before it is disclosed.
How to report
Email support@opentab.cc with the subject "Security". Include:
- the affected version;
- steps to reproduce;
- the impact; and
- a proof of concept, if you have one.
We will try to acknowledge your report within 5 business days and keep you informed until it is fixed.
In scope
- the opentab desktop App, including updates and built-in pages;
- opentab.cc, www.opentab.cc and policies.opentab.cc; and
- the check-in API and admin panel.
Report vulnerabilities in Chromium or Electron themselves to those projects.
Safe harbor
If you research in good faith and follow these rules, we will not pursue legal action against you, and we will not ask anyone else to. You must:
- not access, change or delete other users' data, or keep more of it than you need to prove the issue;
- not disrupt the service, including with denial of service, spam or flooding check-ins;
- not use social engineering or physical attacks;
- test only against your own copy and data;
- give us reasonable time to fix the issue (90 days by default) before disclosing it publicly; and
- follow applicable law.
We do not currently run a paid bug bounty. With your permission, we are happy to credit you.