Vulnerability disclosure policy

OpticWorks builds instruments, software and the store that sells them. Our customers trust us with their accounts, orders and personal information, and we would much rather hear about a weakness from a researcher than from an incident.

This policy describes what is in scope, the rules we ask you to follow, how to reach us, and what you can expect from us in return.

If you make a good-faith effort to follow this policy during your security research:

• We consider your research authorized, and we will work with you to understand and resolve the issue quickly.
• OpticWorks will not initiate or support legal action against you for that research, including claims under computer misuse laws, anti-circumvention provisions such as DMCA section 1201, or our terms of service where they would otherwise restrict security testing.
• If a third party brings legal action against you for activity that complied with this policy, we will make it known that your actions were authorized by us.

You are still responsible for complying with applicable law. This policy cannot authorize testing of systems that belong to other organizations, and it cannot waive the rights of third parties. If you are unsure whether something is authorized, email support@optic.works and ask before you act.

In scope

• optic.works, www.optic.worksCompany website, store, checkout, customer accounts, order tracking and the site's API routes.
• backend.optic.worksCommerce backend. It is not publicly accessible. A way to reach it without authorization is in scope: demonstrate access with a single request and stop.

Parts of the store are in a test rollout and may not be available to you. That is expected. If you find a way around a restriction, report it rather than continuing past it.

Out of scope

• Hostnames not listed above. Do not enumerate or scan optic.works subdomains. If you believe an unlisted host is misconfigured, report the hostname and stop.
• Third-party services we use, such as our payment, shipping, email and hosting providers. Report those to the provider's own program.
• Hardware, firmware and software products that are in development and have not shipped. We will add products to scope as they ship.
• Internal OpticWorks systems, accounts and infrastructure that are not listed in scope.

What we care about most

• Remote code execution
• Authentication bypass, including customer sign-in, password reset and email verification
• Authorization bypass: reading or changing another customer's account, cart, orders, addresses or shipment tracking
• Payment or order integrity flaws, such as completing an order without a valid payment or changing a price
• Server-side request forgery reaching internal services or cloud metadata
• Exposure of credentials, API keys, session tokens or customer personal data
• Stored or reflected cross-site scripting on pages that handle accounts, checkout or payment

Reports we do not act on

• Denial of service, resource exhaustion and rate-limiting weaknesses. Describe them, but do not test them.
• Self-XSS, and issues that require a victim to paste attacker-supplied content
• Missing security headers or cookie flags without demonstrated impact
• Clickjacking on pages without sensitive state-changing actions
• Unvalidated output from automated scanners
• Best-practice suggestions without a working exploit
• Vulnerabilities in third-party dependencies without a working exploit against our services
• Missing SPF, DKIM or DMARC records, or email spoofing without demonstrated impact
• Reports based only on software version numbers
• Social engineering, phishing and physical attacks against OpticWorks staff, offices or partners

These rules are conditions of the safe harbor above.

1. Test only with accounts and data you created yourself.
2. Never access another customer's data. If you reach it, stop, do not copy, keep or describe the contents, and report only the single request that showed the path.
3. Do not run denial-of-service or volumetric tests, and do not test rate limiting, account lockout or brute-force protection.
4. Ask us before running any automated scanning.
5. Do not exfiltrate data, establish persistence or pivot to other systems. Retrieve only the minimum needed to show impact.
6. Use synthetic data. Do not submit real payment cards, real credentials or other people's personal data. Do not place real orders to test a finding.
7. Report privately and keep the issue confidential until a fix has shipped and we have agreed a disclosure date with you.

If a rule prevents you from demonstrating impact, describe the exploitation path instead. We will validate it ourselves, and you will not be penalized for stopping short.

Email support@optic.works with “Security” in the subject line. Please do not report security issues through public channels or social media.

A useful report includes:

• What the vulnerability is and where it is (URL, parameter or feature)
• Step-by-step instructions to reproduce it
• What an attacker could achieve, as concretely as you can show it
• How you would like to be credited, or that you prefer not to be

We may already know about an issue through our own testing. If your report matches a known issue, we will tell you.

Acknowledgement

Within 3 business days

Initial assessment

Within 10 business days

Progress updates

At each significant change, and whenever you ask

Resolution

We tell you when a fix ships

If something takes longer than we expected, we will tell you and explain why.

Please keep the issue confidential until a fix has shipped and we have agreed a disclosure date with you. Once we have assessed your report, we will propose a target date based on severity and on how long affected customers need to receive the fix, and we will explain any extension we ask for.

Where a vulnerability affected customers, we will notify them as appropriate before or alongside public disclosure.

We do not currently offer monetary rewards. With your permission, we will credit you publicly when we disclose the issue, and we will keep you informed from report to fix.

This policy is also published in machine-readable form at /.well-known/security.txt.