Found a security problem? Tell us first
Obleevo is free and run by a small operator. If you find a way around its security, this page says how to tell us, what you may test and how, and what we promise in return.
1. How to report
Write to security@obleevo.com, in French or English.
Say what you found and where; give the steps to reproduce it from a fresh browser; say what an attacker could gain from it, and under what conditions; name the browser and operating system you used, and the version shown on the status page; and tell us whether you would like to be credited, and under what name.
Nothing special is needed to send it: there is no encryption key to look for, and an ordinary email is fine. Leave other people’s data out of it — a report needs a proof, not a sample.
2. What is in scope
The app at obleevo.com, the server behind it, and the relay at turn.obleevo.com.
Above all: the end-to-end encryption between participants; the room proofs, by which participants show each other that they hold the room’s secret; and the file scanner, which checks a file before it is offered.
The Obleevo Vault: its encryption in the browser, the vault page, the offline opener, and the .obleevo file format they implement. A way to open a vault without its passphrase, to alter one without the change being refused, or to learn more from a vault file than the format says it reveals is exactly what we want to hear about.
3. What is out of scope
- Denial of service, and load or stress tests of any kind.
- Spam, social engineering and physical attacks.
- Third-party services, such as Cloudflare, and the browser itself. A flaw in one of them is for its maker to fix; if it affects Obleevo in a way we can work around, we still want to hear about it.
- Reports from automated scanners that do not demonstrate an actual impact.
4. The rules
Test only with rooms and devices you control. Open your own rooms, join them from your own browsers, and attack those.
Never access or keep other people’s data. If you reach some by accident, stop there, look no further, delete what you have, and tell us.
Stop and report as soon as you find something. Do not use one flaw to look for the next.
Give us 90 days before publishing, counted from your report, so that the fix reaches everyone first. If it is fixed sooner, we can agree on an earlier date.
No extortion. A report that comes with a demand for payment, or a threat to publish unless paid, is not research, and this page does not cover it.
5. What we commit to
We will acknowledge your report within 7 days, then keep you informed until it is resolved: whether we could reproduce it, what we are doing about it, and when the fix is live.
If you wish, we will credit you on this page once the fix is live, under the name you choose.
There are no cash rewards. Obleevo is a free service run by a small operator, with no budget for bounties. We would rather say so plainly than have you find out after the work is done.
6. Safe harbour
We will not pursue legal action, civil or criminal, against good-faith research that follows the rules above. It is the same commitment as section 16 of the Terms.
We can only speak for ourselves. Cloudflare, our hosting provider, your internet provider and any other third party are not bound by this page — one more reason to keep to your own rooms and devices.
Threat modelWhat Obleevo protects you from, and what it does not Are you a government, a company or a military service?Work with usLast reviewed:
About · Work with us · Tutorials · Why this · FAQ · Terms · Privacy · Accessibility · Cookies · Threat model · Security audits · Vault format · Contact · What’s new
Obleevo is developed by The House of Brendrof. Proprietary software, free to use.