Vulnerability disclosure policy

In scope

• ososglobal.com and its pages
• Our licence servers on ososglobal.com subdomains
• ReOs and CAD Jet, including their installers

Out of scope

• Services run by others: the Lemon Squeezy checkout and billing portal, Cloudflare, Brevo, and Autodesk Revit and AutoCAD. Report those to their owners.
• Findings with no clear security impact, such as a missing header or a best-practice note without a working attack, or problems that need a device that is already compromised.
• Results from automated scanners that you have not checked yourself.

How to report

E-mail security@ososglobal.com with:

1. what you found and where (the address, product and version);
2. the steps to reproduce it;
3. what an attacker could do with it.

What we ask of you

• Test only with your own accounts and data.
• Do not read, change or delete other people's data, and stop as soon as you reach any.
• No denial of service, spam, social engineering or physical attacks.
• Give us a fair time to fix the problem before you talk about it in public.

Safe harbour

If you make a good-faith effort to follow this policy:

• We treat your research as authorised. We will not take legal action against you or report you to the authorities for it.
• We waive the parts of our EULA and Terms of use that would otherwise forbid the research, such as reverse engineering or testing the licence checks, but only as far as you need to find and show the problem.
• If someone else takes legal action against you for research that followed this policy, we will make it known that you had our permission.
• If you are not sure whether something is allowed, ask us before you test it.

This permission covers only the systems we run. We cannot give permission for services run by others, such as Lemon Squeezy, Cloudflare, Brevo or Autodesk: follow their own policies. It does not cover anything that breaks the law where you are, or using a flaw beyond what your report needs.

Response times

We are a small team, so these are targets, not guarantees:

1. We confirm that we received your report within 3 working days.
2. We send you our first assessment within 10 working days.
3. We aim to fix critical problems within 30 days and others within 90 days, and we update you at least every 14 days until then.
4. Please wait until the fix is out, or 90 days after your report, before you publish details. We agree the date with you.

What we do

We confirm that we received your report, keep you informed while we fix it, and credit you when the fix is out if you wish.

We do not run a paid bug bounty, so we do not pay for reports.