If you believe you have found a security vulnerability in Ockem, we want to hear about it. This page explains how to report it, what we do when you do, and what we ask of you while you look. Ockem’s products are offered by Base22, LLC. For everything else a security review asks, see Security and procurement.
How to report
Email security@ockem.com. Please include:
- what you found and where (the URL or endpoint);
- the steps to reproduce it, and what an attacker could do with it;
- any proof of concept, screenshots or request logs;
- how you would like to be credited, if at all.
Please do not include another person’s data, or any document you obtained through the issue; describe it instead. We do not publish an encryption key yet. If your report needs an encrypted channel, say so in a first email without the details and we will arrange one.
This address is also listed in our security.txt file.
What we commit to
- We acknowledge your report within one business day.
- We confirm whether we can reproduce it, and tell you what we plan to do.
- We keep you updated while we work on a fix, and tell you when it is fixed.
- If you want, we credit you by name once the fix is out.
We do not offer payment for reports.
If a report leads us to confirm, or reasonably believe, that an incident has affected customer data, we notify the affected customers within 72 hours.
Scope
In scope:
- ockem.com and the subdomains Ockem operates, including proof.ockem.com, read.ockem.com and admin.ockem.com.
Out of scope:
- denial of service, load testing, or anything that degrades the service for others;
- social engineering, phishing, or physical attacks against Ockem or Base22 staff or premises;
- services run by others that we use, such as Cloudflare, Stripe, Google or Microsoft. Please report those to the provider;
- reports from automated scanners, and missing best-practice headers or settings, without a demonstrated impact.
Rules for testing
- Use only accounts you own: your own workspace, or the free trial at proof.ockem.com/try.
- Do not access, change or delete data that belongs to anyone else. If you reach another customer’s data by accident, stop, do not keep a copy, and tell us in your report.
- Keep automated testing to a low request rate.
- Give us reasonable time to fix the issue before you disclose it publicly. We ask for 90 days from your report, or until a fix is released if that is sooner, and we will tell you if we need longer and why.
Safe harbor
If you make a good-faith effort to follow this policy, we consider your research authorized. We will not pursue or support legal action against you for it, including under the Computer Fraud and Abuse Act, the DMCA’s anti-circumvention provisions, or similar laws, and we will not report you to law enforcement for it. If a third party brings legal action against you over research that followed this policy, we will make it known that your work was authorized.
If you are unsure whether something you want to try is allowed, ask us first at security@ockem.com.