Orb Security Policy

Thank you for helping keep Orb and its users safe. If you think you've found a security problem, please tell us privately first.

How to report

Email orb@denni.sh.

Please include:

• what you found and why it matters
• the Orb version, from About Orb, and your macOS version
• steps to reproduce it, or a proof of concept
• your name or handle if you'd like credit

Don't send real people's data. If you came across any, tell us it exists and don't include it.

What we'll do

• Confirm we've received your report within 5 business days.
• Tell you whether we can reproduce it and what we plan to do.
• Keep you updated while we work on a fix.
• Credit you when it's fixed, if you'd like.

Orb is published by one person, so please allow for that. We don't currently pay bounties.

Disclosure

We ask you to give us 90 days from your report before publishing, or until a fix ships if that's sooner. If a problem is being actively exploited, tell us and we'll work to a shorter timeline. We'll agree a date with you, and we'll tell you if we need longer and why.

What's in scope

• The Orb app for Mac
• Orb's changes to Chromium
• Orb's update mechanism
• Orb Sync, including its encryption and pairing
• services.orb.surf, and Orb's website at orb.surf

We fix the latest release of Orb. Please check that a problem still exists there.

What isn't

• Bugs in Chromium that aren't specific to Orb. Please report those to the Chromium project at https://issues.chromium.org/, then tell us if Orb needs a faster fix.
• Problems in websites, extensions or Tweaks that Orb didn't make. For a harmful Tweak, use the gallery's Report button.
• Reports that need a Mac that is already compromised, unless Orb makes things worse
• Missing best-practice headers or scanner output without a working impact

Safe harbour

If you act in good faith and follow this policy, we consider your research authorised, we won't bring a claim against you for it, and it doesn't breach Orb's End User License Agreement or the Orb Services Terms.

To stay within this policy:

• Test only against your own Orb install, your own sync group and your own data.
• Don't access, change or delete anyone else's data.
• Don't run denial-of-service tests, spam or social engineering, and don't test against other people's Macs.
• Stop and tell us if you reach data that isn't yours.
• Give us time to fix the problem before you publish.

This covers only what we can authorise. It can't bind other companies, such as our hosting provider, or law enforcement.