Security · Reporting
Report a security issue
If you have found a vulnerability in officeunbound.com, or a weakness in the project’s published design, report it privately first. This page explains how, and how a report is handled while the project is pre-release.
Project status There is no released Office Unbound software yet, so reports today concern this website or the published design. A formal security policy will be published with the source repository.
How to report
First contact through the site, then a private channel for the details.
Send a first-contact message
Use the contact form with Security or community involvement selected. Say what kind of issue it is, what it affects and how to reach you.
Leave out the exploit
Do not put proof-of-concept code, step-by-step reproduction, credentials or anyone’s personal data in that first message. Website messages arrive in a general support queue; they are not public, but they are not restricted to security staff either.
Agree a private channel
The reply will propose a way to send the details privately. Full technical detail goes there, not through the form.
Coordinated disclosure
The issue is fixed, or mitigated, before it is discussed publicly, and the timing is agreed with the reporter. Credit is given if wanted.
What is in scope
- This website, officeunbound.com, and its forms
- Weaknesses in the published architecture or security design
- Office Unbound source code, once it is published
What belongs elsewhere
Vulnerabilities in the open-source components Office Unbound evaluates — mail servers, office editors, file platforms, messaging — belong to those projects’ own security processes. Report them there first. If an issue spans a component and Office Unbound’s integration, say so in the first message and it will be routed accordingly.
There is no dedicated security mailbox yet: officeunbound.com does not send or receive email, and an address will only be published once mail for the domain is set up properly. No response times are promised until the formal policy exists.
Found something?
Start with a short first-contact message. Leave the details for the private channel.