Security and responsible disclosure

Report a vulnerability

Email security@originpixel.in with the steps to reproduce, the affected URL or feature, and what an attacker could do. We reply within 3 working days, keep you updated, and aim to fix critical issues within 7 days and high ones within 30 days.

Safe harbour

If you act in good faith and follow this page, we will not take legal action against you and we will not ask the authorities to. Please:

• Test only with accounts you own or have permission to use. Never access, change or delete other people's data.
• Stop and tell us as soon as you reach data that is not yours.
• Do not run denial-of-service, spam, social engineering or physical attacks.
• Give us reasonable time to fix the issue before you tell anyone else.

In scope

app.originpixel.in and its APIs, the web chat widget, and the Origin Platform source we publish.

Out of scope

Reports from automated scanners without a working impact, missing headers on static files, self-XSS, clickjacking on pages without actions, rate limits on non-sensitive pages, and issues in third-party services we use (report those to the vendor).

Thanks

With your permission we list everyone who reported a valid issue here.

How we protect your data

Every business's data is separated by database row-level security, sign-ins support two-step codes, passkeys and single sign-on, sensitive actions ask you to confirm it is you, and every change to security settings is in the audit log. See Privacy and Data processing.

Machine-readable contact: /.well-known/security.txt