Reporting a security issue
If you have found a vulnerability in OTPWire, we want to hear about it. This page says how to report it, what we commit to, and what is in scope.
How to report
Write to security@otpwire.dev, in English or Italian. Tell us what you found, where (the URL or the API endpoint), the steps to reproduce it, and the impact you believe it has.
What we commit to
- A first reply within 72 hours.
- Keeping you informed while we work on it, and telling you when it is fixed.
Scope
In scope: otpwire.dev (this site and the documentation under
/docs/), the API at api.otpwire.dev, and the mail server
mx1.otpwire.dev.
Out of scope: the third-party services we rely on (report those to them directly), denial of service and load testing, social engineering, physical attacks, and scanner output without a demonstrated issue.
While testing
- Use your own account and your own inboxes.
- Do not access, change or delete other people's data. If you reach it by accident, stop and tell us.
- Do not publish the issue before it is fixed: we will agree a date with you.
Found an OTPWire API key published somewhere? They start with otpw_live_. Write to
the same address: we revoke it and notify the owner.
Recognition
There is no bounty. With your consent, we thank you publicly on the acknowledgments page, with your name or your company and a link to your LinkedIn profile.
Machine-readable contact: /.well-known/security.txt.