Coordinated vulnerability disclosure
If you have found a vulnerability in Obsigen, Obsigen Forge, Obsigen Runtime or this website, we want to hear from you - and we will not take legal action against good-faith research that follows the rules below.
Contact
- security@obsigen.com
- Please write in English or Polish; include steps to reproduce, affected component and version (hash from the release note for Forge / Runtime), and impact as you see it.
- We acknowledge every report within one business day.
Scope
- Obsigen product: tenant frontend and API, Central (stateless backend), sandbox, Obsigen Magnify, Design.
- Obsigen Forge (VS Code extension) and Obsigen Runtime.
- This website (obsigen.com).
- Out of scope: third-party model providers and public data sources we query (report to them directly); denial-of-service testing; social engineering of our staff; anything requiring physical access.
Rules for researchers
- Test only against your own tenant or a test tenant we set up for you - never against another customer's server.
- Do not access, modify or exfiltrate data that is not yours; stop and report as soon as you have proof.
- Give us reasonable time to fix before public disclosure; we coordinate the disclosure date with you and credit you if you wish.
What we do
- Triage and severity assessment; fix and release with a hash in the release note; SBOM (CycloneDX) for Forge and Runtime.
- For an actively exploited vulnerability: early warning to the authorities within 24 hours and a notification within 72 hours of becoming aware, as required by the Cyber Resilience Act; affected users are informed with mitigation steps.
- For every fix we publish a note in the changelog.
Po polsku
Podatności w Obsigen, Obsigen Forge, Obsigen Runtime i tej stronie zgłaszajcie na security@obsigen.com. Potwierdzamy odbiór w ciągu jednego dnia roboczego, naprawę wydajemy z hashem w notatce wydania, a w przypadku aktywnie wykorzystywanej podatności stosujemy procedurę CRA: wczesne ostrzeżenie w 24 h i zgłoszenie w 72 h. Testujcie tylko na własnym tenancie; nie podejmujemy kroków prawnych wobec badań prowadzonych w dobrej wierze według powyższych zasad. Producent: Visera P.S.A. (www.visera.eu).