Steps to reproduce
Clear, numbered steps someone on our team can follow. Screenshots or a short screen recording help a lot.
Responsible disclosure
Found a hole?
Tell us, safely.
Octabiz welcomes reports of security vulnerabilities from independent researchers. We will not pursue legal action against anyone who reports a vulnerability in good faith and in line with the policy on this page.
How to report.
Send one email to security@octabiz.ai. Please don't post the issue publicly until we've had a chance to fix it.
Impact
What an attacker could actually do with it — read another organization's data, change a record, take over an account.
Affected URL or endpoint
The exact page, API route or function involved, plus the account or role you were signed in as.
What's in scope.
In scope
- octabiz.ai and its subdomains
- The core Octabiz web application you sign in to
- Storefronts and public pages we host on our own domains
- Our public APIs and edge functions
Out of scope
- Third-party services we don't control (payment providers, messaging providers, hosting dashboards) — report those to the provider
- Social engineering of our staff, customers or suppliers
- Physical attacks against offices, people or hardware
- Denial-of-service, load testing, or anything that degrades service for real customers
- Automated scanner output with no demonstrated impact
What happens after you send it.
- We aim to acknowledge your report within 3 business days. That's a real person confirming we received it and started looking.
- We investigate, tell you whether we could reproduce it, and share a rough remediation timeline once we understand the fix.
- We'll agree a disclosure timeline with you rather than asking you to stay quiet indefinitely, and we're happy to credit you when the fix ships.
- This is a responsible-disclosure channel, not a paid bug bounty. We don't offer payment or rewards for reports today. If that changes, we'll say so on this page.
Report in good faith,
and you're covered.
If you follow this policy — test only your own accounts, stop as soon as you've proved the issue, never access or change other people's data, and give us a reasonable chance to fix it before going public — we will treat your research as authorised and will not pursue legal action against you.