Vulnerability disclosure policy

If you have found a security vulnerability in this platform, we want to hear about it, and we will treat you fairly for telling us. This page says how to report it, what we commit to in return, and what good-faith testing we authorise.

How to report

Email ben@owlettsfarm.com. Please do not report vulnerabilities through public channels or issue trackers.

Include, as far as you can:

• a description of the vulnerability
• steps to reproduce it
• the affected hostname and component, if known
• your own view of its severity, if you have one

The machine-readable version of this policy is at /.well-known/security.txt on every hostname we serve (RFC 9116).

What we commit to

• Acknowledgement within 2 business days.
• Initial assessment within 5 business days.
• Resolution timeline communicated after assessment, proportionate to severity.

We will keep you informed of progress and tell you when the issue is resolved.

Scope

This policy covers the Ecology platform: every hostname served by it, including

• ecology.land and its subdomains, including tenant-branded sites and the sign-in service;
• the API under /api/ on those hostnames;
• owlettsfarm.com, which is served by the same platform.

Out of scope:

• sos.owlettsfarm.com, a separate static site;
• third-party services we depend on (our hosting, email and code-hosting providers) — report those to the provider;
• social engineering of our people or our users;
• denial-of-service testing of any kind.

Safe harbour

We will not take legal action against researchers who:

• act in good faith and follow this policy;
• avoid accessing, modifying or exfiltrating data belonging to other users;
• report findings promptly and do not disclose them publicly before we have resolved them;
• do not exploit a vulnerability beyond what is necessary to demonstrate it.

Testing we authorise

Security testing is authorised for anyone acting in good faith under this policy, within the scope above, on these conditions:

• no automated scanning that degrades service availability, no brute-force attacks, no social engineering, no physical attacks;
• do not access, modify or exfiltrate data belonging to other users;
• all findings are reported to us by the email above before any public disclosure.

If you need a test account to assess authenticated flows, ask us and we will provision one for you.

Who we are

The Ecology platform is operated by Owletts Farm Partnership, United Kingdom. Our privacy notice explains how we handle personal data, including yours when you report to us.