Security policy
This page says how to report a security problem in ownpaas, what happens after you report it, and which versions get security updates.
ownpaas is not released yet. The reply times apply to reports from today; the update rules apply from the first release.
How to report
Section titled “How to report”Send an email to security@mitjamartini.com. The same address is in /.well-known/security.txt. You can write in English or German.
There is no OpenPGP key for this address yet. It will be published here and in security.txt. Until then, if your report holds details that should not travel unencrypted, send a short description first and we agree how to send the rest.
Please do not report vulnerabilities in a public issue, a forum or social media.
What to include
Section titled “What to include”- what you found, and what an attacker could do with it;
- the steps to reproduce it, or a proof of concept;
- the version of ownpaas (ownpaas › About ownpaas) and of macOS, or the address on ownpaas.com;
- whether you know or believe that the vulnerability is already being exploited. Say so even if you are not sure: it changes how fast we have to act and whom we have to inform;
- whether anyone else knows about it;
- whether and how you want to be named in the advisory.
What happens after you report
Section titled “What happens after you report”| Step | When |
|---|---|
| We confirm that we received your report | within 3 working days |
| We tell you our assessment: whether we can reproduce it, and its severity | within 10 working days |
| We release a fix or a documented workaround | by severity, see below |
Working days are Monday to Friday, except public holidays in Berlin.
We rate severity with CVSS (version 3.1 or 4.0). The targets for a fix count from our assessment:
| Severity | CVSS score | Target for a fix |
|---|---|---|
| Critical | 9.0 to 10.0 | 14 days |
| High | 7.0 to 8.9 | 30 days |
| Medium | 4.0 to 6.9 | 90 days |
| Low | 0.1 to 3.9 | the next regular release |
If we cannot meet a target, we tell you why and when we expect the fix. We keep you informed until the report is closed.
Coordinated disclosure
Section titled “Coordinated disclosure”We ask you to keep the vulnerability confidential until a fix is released, and for at most 90 days after your report. After 90 days you may publish, fix or no fix. If we need more time, we ask you before the 90 days end, and say why.
We publish an advisory when the fix is released. If a vulnerability is actively exploited, we may publish earlier, so users can protect themselves.
Supported versions
Section titled “Supported versions”Each version of ownpaas gets security updates for 5 years from its release.
- We fix vulnerabilities in the newest version. Every version can update to the newest version free of charge, so the 5 years are met by that update.
- Security updates are free of charge, also after a licence has lapsed.
- The app installs updates automatically by default. You can turn this off in Settings › About › Updates. The update feed is public and does not need a licence key.
- The release notes give each version’s release date. Its support period ends 5 years after that date.
No version is released yet, so no version is supported today.
Advisories
Section titled “Advisories”We publish an advisory for each fixed vulnerability that affected a released version:
- in the release notes of the version that fixes it, which the app’s updater shows;
- on this page, under this heading.
An advisory says which versions are affected, what the vulnerability allows, how severe it is, which version fixes it, and what you can do until you have updated. It names a CVE ID if one was assigned, and credits the reporter if they want.
There are no advisories so far.
In scope:
- the ownpaas app and the programs it ships: the engine, its helpers, the MCP server and
ownpaas-mgmt; - the software the app installs on the gateway server in your cloud account;
- the update feed and the website ownpaas.com.
If you find a vulnerability in a component that ownpaas ships, for example an open-source library, report it to us too. We pass it on to the project that maintains it.
Out of scope: Paddle’s checkout and its buyer portal (report to Paddle), your cloud provider’s services, and the apps you run in your labs.
Safe harbour
Section titled “Safe harbour”We do not take legal action against you, and do not ask anyone else to, for research that follows this policy in good faith. That means:
- test only on your own Mac, your own installation of ownpaas and your own cloud accounts;
- do not access, change or keep data of other people. If you reach such data, stop, and tell us what you saw;
- do not run denial-of-service tests against ownpaas.com, and do not use social engineering, phishing or physical attacks;
- give us the time described under “Coordinated disclosure” before you publish.
If someone else takes legal action against you for research that followed this policy, we will state that the research was done in good faith and within this policy.
There is no bug bounty. We name you in the advisory if you want.