How we protect observatory.global, and how to report a security vulnerability to us safely. We welcome reports from security researchers and will not pursue good-faith research that follows this policy.
1. How we protect the service
We protect the service with encrypted connections, a security and delivery service that filters attacks, a strict content security policy, rate limits and lockouts, two-step sign-in, passwords stored only as one-way hashes, encryption of sensitive fields, least-privilege access for staff, monitoring and tested backups. We review and update these measures as threats change. No system is perfectly secure, which is why we value your reports.
2. How to report a vulnerability
Email contact@observatory.global with the subject line Security report. Please include:
- the affected address (URL), feature or component;
- a description of the vulnerability and its possible impact;
- the steps to reproduce it, with any proof-of-concept code, screenshots or requests;
- how you would like to be credited, if at all, and how to contact you.
You can write in English or French. Do not include other people's personal information. Our machine-readable contact details are at /.well-known/security.txt.
3. Scope
In scope: observatory.global and every site under it, its accounts, community, forms and published interfaces, and the plugins and themes we develop for it.
Out of scope: denial-of-service and load testing; social engineering, phishing or physical attacks on our staff, members or premises; spam; reports from automated scanners without a demonstrated impact; missing best-practice headers without a demonstrated impact; vulnerabilities in third-party services we use, such as our security and delivery service or our hosting provider, which you should report to them; and devices or stations owned by members.
4. Rules for researchers
- Test only against accounts you own or have permission to use, and never access, change or delete other people's data. If you reach personal information by accident, stop, do not keep it, and tell us.
- Do only what is needed to demonstrate the issue. Do not degrade the service, send spam or run automated scans at high volume.
- Do not use a vulnerability beyond what is needed to confirm it, and do not install persistent access.
- Give us reasonable time to fix the issue before you disclose it, and do not disclose details while members remain at risk.
- Follow the law where you are.
5. What we commit to
- We acknowledge your report within 3 business days.
- We give you an initial assessment within 10 business days and keep you informed until the issue is resolved.
- We aim to fix critical issues as quickly as possible and other confirmed issues within 90 days, and we coordinate the disclosure date with you.
- With your permission, we credit you publicly once the issue is fixed.
- If you act in good faith and follow this policy, we consider your research authorized, we will not take legal action against you or report you to the authorities for it, and if a third party takes action against you for research that followed this policy, we will make it known that your research was authorized.
We do not offer payment for reports.
6. security.txt
We publish the following file at /.well-known/security.txt, in the format of RFC 9116:
Contact: mailto:contact@observatory.global
Expires: 2027-10-27T23:59:59Z
Preferred-Languages: en, fr
Canonical: https://observatory.global/.well-known/security.txt
Policy: https://observatory.global/legal/security/