Security & Responsible Disclosure

This policy applies to security research directed at Open Almond Studios systems that we own or control, primarily openalmond.com and first-party application functionality served through that domain. It is intended to provide a clear reporting path, not blanket authorization to access data or systems beyond what is reasonably necessary to demonstrate a vulnerability.

When evaluating a suspected vulnerability, please:

• Use accounts and data you own or are expressly authorized to use whenever possible.
• Limit testing to the minimum activity reasonably necessary to confirm the issue.
• Stop and report the issue if you gain access to personal, confidential, privileged, or otherwise sensitive data that is not yours.
• Avoid changing, deleting, downloading, publishing, or retaining other people's data.
• Avoid materially degrading service availability or interfering with normal users.
• Give us a reasonable opportunity to investigate and remediate before publicly disclosing details that could enable abuse.

If research is conducted in good faith and follows this policy, Open Almond does not intend to pursue a claim solely because of that compliant research. This statement cannot bind third parties or government authorities and does not waive rights relating to conduct outside this policy.

Please do not perform:

• Denial-of-service, distributed denial-of-service, traffic flooding, or resource-exhaustion testing.
• Destructive testing, ransomware simulation, persistence, data wiping, or intentional corruption.
• Credential stuffing, password spraying, broad brute-force attacks, or testing with stolen credentials.
• Phishing, pretexting, social engineering, or attempts to deceive staff, users, vendors, or partners.
• Physical-security testing or attempts to access offices, devices, or facilities.
• Automated scanning at a rate or scale that creates unreasonable load or disrupts normal service.
• Testing against third-party infrastructure or services that Open Almond does not own or control.

Email support@openalmond.com with the subject Security Vulnerability Report. Please do not publish sensitive details in a public issue, social post, Discord channel, or other public forum before we have had a reasonable opportunity to investigate.

A useful report includes:

• The affected URL, endpoint, feature, or component.
• A concise description of the security impact.
• Reproduction steps or a minimal proof of concept.
• Any conditions required to reproduce the issue.
• Whether you encountered data that was not yours and, if so, whether you stopped testing.
• A preferred contact method for follow-up.

We will review credible reports and prioritize them based on likely impact, exploitability, affected users, and available mitigations. We may ask follow-up questions or request limited additional evidence. Response and remediation times vary by severity and complexity, so this policy does not promise a fixed service-level deadline.

No bug bounty, payment, reward, public credit, or other compensation is offered unless Open Almond expressly agrees to it in writing for a particular report or program.

Open Almond uses third-party providers for hosting, authentication, storage, email, commerce, analytics, and other functions. This policy does not authorize testing against a provider's systems merely because Open Almond uses that provider. Follow the provider's own vulnerability-disclosure or security policy when an issue exists in infrastructure they control.

Our machine-readable disclosure contact is also published at /.well-known/security.txt.