Reporting issues

If you think you have found a vulnerability in On-Call Optimizer, or you see unexpected behaviour that may be a security issue, follow the steps below.

Reporting a vulnerability

Email urgent-issue@oncall-optimizer.com with a description of the issue and, if you know them, the steps to reproduce it.

If you use On-Call Optimizer, open the Support page (click ? in the top navigation bar and choose Support, or go to https://app.oncall-optimizer.com/help). Put the phrase shown on that page in the subject line so we see the report sooner.

Responsible disclosure

When you find a vulnerability:

• Send it to us using the steps above.
• We acknowledge it within 1 working day and give you a named contact.

After a vulnerability is reported:

• Within 5 working days we analyse it and describe what we plan to do. If we need longer than that, we send regular updates.
• We may ask you to work with us on the fix.

After a fix is deployed:

• We tell affected customers about the vulnerability and the fix.
• If you want, we credit you for finding it, reporting it and helping to fix it.

We expect you to act professionally, keep the report confidential, and tell On-Call Optimizer first, so we can protect customers.

Acknowledgements

If you find a vulnerability and follow this process, we will credit you on this page if you ask us to.