Reporting a security issue

If you have found a vulnerability in Omnibus Readers, thank you — please tell us privately so it can be fixed before anyone else finds it. This page is the policy behind /.well-known/security.txt.

Reporting

Join the Discord and send a private message to a moderator saying you have a security report. They will arrange a private channel for the details.

Please do not post vulnerability details on the feedback board, in public Discord channels, or anywhere else public until the issue is fixed.

A useful report includes:

• the page, endpoint or feature affected, and what an attacker could do;
• steps to reproduce, with the requests involved if you have them;
• whether you accessed any data that is not yours, and what.

Scope

• omnibusreaders.com and its subdomains, and the code that runs them.
• Out of scope: the third-party services the site links to or embeds (retailers, Discord, Google sign-in, Cloudflare), findings that need a compromised device or browser, missing best-practice headers with no demonstrated impact, and volumetric denial of service.

Safe harbour

We will not pursue or support legal action against research that is done in good faith and within these limits:

• test against your own account, or accounts you have permission to use;
• stop as soon as you reach data that is not yours, do not keep or share it, and tell us what you saw;
• no denial of service, spam, social engineering of members or staff, or automated scanning heavy enough to degrade the site for others;
• give us a reasonable chance to fix the issue before disclosing it.

What happens next

• We aim to acknowledge a report within 7 days.
• We will keep you told of progress, and tell you when it is fixed.
• Please allow 90 days from acknowledgement before disclosing publicly; we will agree an earlier date once a fix is live, or a later one if a fix genuinely needs it.
• This is a hobbyist site: there is no bug bounty, but we are happy to credit you when the fix ships if you would like.