Resources · Community
Community and contributions
Office Unbound is meant to be developed in the open, with public source, public discussion and a clear way to report security problems. This page explains what exists now, what will exist when the repository is published, and how to take part.
Project status The public repository has not been published yet. Contribution guidelines and a code of conduct will be published with it.
Where things stand
The project is in Phase 1, architecture and evaluation. The work so far is component selection, licensing review, security architecture and integration design. None of that is code anyone else can build or run yet. Publishing a repository before there is something meaningful in it would invite contributions with nowhere useful to go.
Publishing will be announced on project updates, and registered developers will be told directly. Until then there is no official Office Unbound repository, issue tracker or chat room. If you find one that claims to be, it is not ours.
How to take part now
Several routes are open before any code is public, and they shape what gets built first.
Follow development
Read the roadmap and project updates. Updates are dated and record decisions as they are made, including components rejected and why.
Register to test
Early-access registration says which workloads you would test first and what you run today. That informs the order of work and who is contacted when a component reaches early testing.
Register as a developer
The developer interest form asks where you could help. Registered developers hear first when the repository opens and where help is most needed.
Planned contribution areas
Where outside help is expected to matter most once the repository is public.
- Provisioning and administration
- The services that create tenants, users and mailboxes across components, apply policy and expose the management API. Most of the custom Office Unbound code will live here.
- Web interface
- The unified interface over mail, files, documents, chat and meetings, including accessibility and keyboard behavior.
- Desktop and mobile clients
- Branding, enrollment and policy work on top of established open-source sync client technology, for Windows, macOS and Linux.
- Migration connectors
- Discovery and transfer for Microsoft 365 and Google Workspace sources: API handling, rate limits, conversion and verification.
- Component integration
- Work that touches the upstream projects Office Unbound builds on. Where a fix belongs upstream, the intent is to contribute it upstream instead of carrying a private patch.
- Security review and testing
- Authorization and tenant-isolation testing, dependency review and code review of security-sensitive paths.
- Documentation
- Deployment, operations and administrator guides, written for people who run the platform as well as people who evaluate it.
- Packaging and deployment
- Repeatable deployment on the initial target, Linux virtual machines on Proxmox VE, and later on other environments.
Guidelines and conduct
A contribution guide and a code of conduct will be published with the repository, not before. The contribution guide will cover how changes are proposed and reviewed, testing expectations, how work is split between Office Unbound and the upstream projects, and how contributed code is licensed.
That last point depends on a decision not yet made: the license for Office Unbound’s own code has not been selected. Contributions will not be accepted until it has been, so every contributor knows the terms their work is offered under.
- Public source repository
- Issue tracker and discussion forum
- Contribution guide and code of conduct
- License for Office Unbound’s own code
- Dedicated security disclosure channel
Reporting a security issue
There is little Office Unbound code to find problems in yet. But this website is live, and research during evaluation may turn up issues in components we are assessing. Reports are welcome either way.
Make first contact privately
Until a dedicated disclosure channel is published, use the contact form and choose Security or community involvement. Describe the kind of issue and what it affects, but do not include exploit code, proof-of-concept details or sensitive data in that first message.
We reply with a private channel
A person reads the message and replies to arrange a way to exchange the details privately.
Coordinated disclosure
The intent is coordinated disclosure: we confirm the issue, work on a fix, and agree a disclosure timing with the reporter that lets operators patch first. Reporters are credited if they wish.
Upstream issues go upstream
If the issue is in a component such as a mail server or file platform, it belongs to that project’s own security process. We will help route it there and will not disclose it ahead of that project.
Advisories
Once there are releases, fixed vulnerabilities will be published as security advisories with affected versions and remediation, so customers and MSPs can decide when to apply updates with the facts in hand.
A formal security policy, with a dedicated reporting address and response targets, will be published with the repository. No response times are promised until then.
Interested in contributing?
Tell us where your experience lies. Registered developers are told when the repository opens and where help is needed first.