Security and Vulnerability Disclosure

1. Reporting

Use Support → Security without signing in. Include the affected Orbitty URL or component, a concise description, a minimal reproduction using accounts and data you control, potential impact and a safe contact. Redact secrets and personal data. If evidence cannot be sent safely through the form, describe the issue first and request a restricted evidence channel.

2. Scope and safe testing

This policy concerns Orbitty-controlled public application services at orbitty.land. It does not authorise testing a cloud provider, map provider, payment processor, identity service or another organisation. Use the least intrusive method and stop when enough evidence exists to explain a weakness.

Do not access or retain other users’ records, modify or delete real data, bypass a person’s account, run denial-of-service or high-volume tests, send unsolicited messages, perform phishing or social engineering, deploy persistence or malware, or publicly disclose private evidence. If you unexpectedly encounter sensitive data, stop, do not copy it further, and tell us how it was encountered.

3. Response and coordinated disclosure

We aim to acknowledge a credible report within seven days and provide a progress update within 30 days where practical. Response depends on severity and the information available; this is not an emergency channel or a guaranteed resolution deadline. We may ask you to avoid public disclosure for a reasonable period while we investigate and protect users. We will discuss a coordinated disclosure date where possible. No bounty or payment is promised.

4. Good-faith reporting

We welcome good-faith, proportionate reports made within this policy. We do not intend to pursue a claim merely because a person responsibly reports a vulnerability in accordance with it. This statement cannot grant immunity under applicable law, waive another party’s rights or authorise prohibited testing. Ask for written clarification before testing that would exceed the scope. Our handling of report data follows the Privacy Notice.