Vulnerability disclosure policy

In scope: the SigningUS and OurOpero web applications, their APIs, and the websites signingus.com and ouropero.com.

Out of scope: services we use but do not operate, social engineering of our staff or customers, physical attacks, denial of service, spam, and automated scanner findings with no demonstrated impact.

Email security@signingus.com with the product, the URL or endpoint, steps to reproduce, and the impact you believe it has. Screenshots or proof-of-concept code help.

We do not currently run a paid bug bounty. With your permission, we will credit you on this page once the issue is fixed.

• Test only against accounts you own or have permission to use.
• Do not access, change or delete data that is not yours. If you encounter customer data, stop and tell us. Do not download or keep it.
• Do not degrade the service with denial-of-service tests or high-volume automated scanning.
• Give us reasonable time to fix the issue before disclosing it. We ask for 90 days from our acknowledgement.

If you act in good faith and follow this policy, we will consider your research authorized and will not pursue legal action against you for it. This does not cover activity outside the scope above or contrary to "What we ask of you".

Researchers who have reported valid issues will be listed here with their permission.