1. How to report
Email security@offseq.com. Reports in English or Latvian are welcome. Please include:
- the affected URL, endpoint or component;
- a description of the vulnerability and its potential impact;
- step-by-step reproduction instructions or a proof of concept;
- any accounts, report IDs or timestamps relevant to your testing;
- how you would like to be credited, if at all.
If you need an encrypted channel, say so in your first message and we will arrange one. You may also report through the Latvian national CERT, CERT.LV, which can coordinate the disclosure with us. Our machine-readable contact details are published in /.well-known/security.txt.
2. Scope
This policy covers:
- guard.report and www.guard.report, including all pages and
/api/* endpoints; - guard.offseq.com (legacy host that redirects to guard.report);
- Guard reports, PDF exports and emails generated by the platform;
- the Guard scanning engine, including how it handles the websites it scans.
The following are out of scope:
- third-party services we use (for example Cloudflare, EveryPay, our email provider and hosting provider): please report those to the vendor directly;
- denial-of-service or volumetric testing, and anything that degrades the service for other users;
- social engineering, phishing or physical attacks against OffSeq staff, offices or customers;
- findings from automated scanners without a demonstrated, exploitable impact;
- missing security headers, banner or version disclosure, or cookie flags without a working exploit;
- self-XSS, clickjacking on pages with no sensitive actions, and CSRF on logout or other state-free actions;
- issues that require a compromised device, browser or a physically present attacker;
- rate limiting on non-sensitive endpoints.
3. Rules for testing
- Only test against accounts, reports and data that you own or have explicit permission to use. You may scan your own domains with Guard as part of your research.
- Do not access, modify or delete other people’s data. If you encounter personal data, payment information, unlock codes or credentials, stop, do not copy or retain it, and tell us immediately.
- Use the minimum access necessary to demonstrate the issue. Do not pivot to other systems, establish persistence or exfiltrate data.
- Do not make payments with payment details that are not yours, and do not attempt to obtain paid content without paying.
- Do not run tests that could disrupt the service, flood our queues, send email to third parties or trigger scans of websites you do not control at scale.
- Give us a reasonable time to fix the issue before disclosing it publicly (see section 5).
4. Safe harbour
If you make a good-faith effort to comply with this policy, we consider your research authorised. We will not pursue or support legal action against you, and we will not report you to law enforcement, for activity that complies with this policy. If a third party brings legal action against you for such activity, we will make it known that your actions were conducted in compliance with this policy.
If you are unsure whether a test is consistent with this policy, ask us at security@offseq.com before you proceed. This safe harbour applies only to OffSeq systems listed in scope; we cannot authorise testing of third-party systems.
5. What you can expect from us
- Acknowledgement of your report within 3 business days.
- An initial assessment, including whether we can reproduce the issue, within 10 business days.
- Status updates at least every 14 days until the issue is resolved.
- Remediation of confirmed critical and high-severity issues as a priority, and in any case within 90 days of the report.
- Coordination with you on the timing and content of any public disclosure. If we have not resolved a confirmed issue within 90 days, we will agree a disclosure date with you, or with CERT.LV where it is coordinating.
6. Recognition
We do not currently run a paid bug bounty programme. With your permission, we will publicly credit you for confirmed vulnerabilities once they are fixed.
7. Website owners: scans by Guard
Guard assesses the public-facing security of websites that users submit. Scans use only information any visitor can obtain and do not attempt to exploit vulnerabilities. If you operate a website and do not want it scanned or listed by Guard, email guard@offseq.com from an address at that domain and we will exclude it. We can also give you the details of our scanning infrastructure on request.
See also our Terms & Conditions and Privacy policy.