Responsible disclosure
How to report a security vulnerability in otvista.com or OTVista services, and what you can expect from us.
OTVista works in cybersecurity, and we take the security of our own systems seriously. If you believe you have found a vulnerability in this website, please tell us so we can fix it.
How to report
- Email contact@otvista.com with the subject "Security report".
- Describe the issue, the affected URL, steps to reproduce and the potential impact.
- Do not include personal data of other people. If you accessed any by accident, tell us and delete it.
Our machine-readable contact details are published in security.txt (RFC 9116).
Scope
In scope: otvista.com and its subpages, including the contact form and the browser-based tools. Out of scope: third-party services we use (such as our hosting provider), physical security, and social engineering of people.
Please do
- Act in good faith and test only with your own data and accounts.
- Give us reasonable time to fix the issue before disclosing it publicly.
Please do not
- Run denial-of-service tests, automated high-volume scanning or spam the contact form.
- Access, change or delete data that is not yours, or keep access longer than needed to show the issue.
- Use the issue to harm OTVista, our visitors or anyone else.
What you can expect
- We aim to acknowledge reports within five business days and keep you updated.
- We will not pursue legal action against good-faith research that follows this policy.
- With your permission, we are happy to credit you once the issue is fixed. We do not currently run a paid bug bounty.