Obsignor handles confidential governance data, and we take the security of the Service seriously. We welcome reports from security researchers and will work with you to understand and resolve genuine issues quickly. This page is our vulnerability disclosure policy (VDP); it is referenced by our security.txt.
1. How to report
Email obsignor@gmail.com with enough detail for us to reproduce the issue: the affected URL or feature, a description of the vulnerability and its impact, and step-by-step reproduction (proof-of-concept code, requests, or screenshots are helpful). If the report is sensitive, say so and we will arrange an encrypted channel before you share details.
Please report privately and give us a reasonable opportunity to remediate before any public disclosure. Do not file security issues in public trackers.
2. Safe harbour
We will not pursue or support legal action against researchers who, in good faith and in accordance with this policy: make a genuine effort to avoid privacy violations, data loss or destruction, and service degradation; only interact with accounts they own or have explicit permission to test; and give us a reasonable time to respond before disclosing. Activity conducted consistently with this policy is considered authorised, and we will not treat it as a breach of our Terms.
3. In scope
- The Obsignor web application and its authenticated product surfaces.
- The public API (
/api/v1/*) and webhooks delivery. - Authentication, session handling, and tenant-isolation boundaries.
- The marketing site and public endpoints (lead capture, exports).
4. Out of scope
The following are generally not eligible unless you can demonstrate a concrete, exploitable security impact:
- Denial-of-service, volumetric, or brute-force/rate-limit testing against production.
- Social engineering, phishing, or physical attacks against our staff, users, or facilities.
- Reports from automated scanners without a validated, reproducible finding; missing best-practice headers with no demonstrated impact.
- Vulnerabilities in third-party services we use, which should be reported to those providers.
Please only ever test against accounts and organisations you control. Never access, modify, or exfiltrate another tenant’s data — a proof-of-concept that demonstrates cross-tenant access without retaining data is sufficient.
5. Our commitment
We aim to:
- Acknowledge your report within 3 business days.
- Provide an initial assessment and a triaged severity within 10 business days.
- Remediate on a severity-based timeline — critical issues addressed with the highest priority — and keep you updated on progress.
- Credit you for the report if you would like acknowledgement.
Obsignor does not currently operate a paid bug-bounty program; this is a coordinated disclosure policy.