Security and vulnerability disclosure policy

Email security@olympuspay.co with a description of the issue, the steps to reproduce it, the affected page or feature and, if you can, a proof of concept that does not put anyone's information at risk. If the report is sensitive, ask for a secure channel and we will arrange one.

• Acknowledge your report within three business days.
• Assess it and tell you whether we accept it as a vulnerability, within ten business days where we can.
• Keep you informed about progress and tell you when it is fixed.
• Credit you publicly, if you want that, once it is fixed.
• Not pass your details to anyone except as needed to fix the problem or as the law requires.

We do not currently run a paid bounty programme.

• Test only against accounts you own or have permission to use, and never against another customer's data.
• Stop and report as soon as you reach information that is not yours. Do not view, copy, change or delete it, and do not keep it.
• Do not run denial-of-service, spam, social engineering or physical attacks, and do not use automated scanners at a rate that affects the service.
• Give us reasonable time to fix the issue before you tell anyone else about it, and do not publish details that would let others exploit it before it is fixed.

In scope: the THEMIS web application, client portal, signing and sharing pages, and the public website. Out of scope: third-party services we use, social engineering of our staff or customers, reports that depend only on out-of-date browsers, missing security headers with no demonstrated impact, and theoretical issues without a working demonstration.

If you follow this policy in good faith, we will treat your testing as authorised for the purposes of this policy, will not take legal action against you for it, and will say so if another party starts one. This does not authorise any activity that breaks the law in a way this policy does not cover, and it does not bind third parties. The Cybercrime and Computer Related Crimes Act of Botswana and similar laws elsewhere still apply, and this policy is not a licence to ignore them. If you are unsure whether something is covered, ask first.

Our security contact is also published at /.well-known/security.txt.