Security & Vulnerability Disclosure

1. How to report

Email oracle@inifye.tech with:

• a clear description of the issue and its impact;
• the affected URL(s) or endpoint(s);
• step-by-step reproduction, ideally with a proof-of-concept;
• your name and preferred contact method for follow-up.

For sensitive reports that require encryption, request our current public key by emailing oracle@inifye.tech with the subject line “PGP key request” before sending the report body.

2. Scope

In scope:

• The production Construction OS platform on our official domains.
• Authentication, authorisation and workspace-isolation issues.
• Server-side and client-side injection, SSRF, IDOR.
• Sensitive data exposure.

3. Out of scope

• Denial-of-service (DoS/DDoS), volumetric or rate-limit attacks.
• Social engineering of employees, users or vendors.
• Physical attacks against offices or infrastructure.
• Reports produced solely by automated scanners without demonstrable impact.
• Best-practice reports lacking a concrete security impact (e.g. missing security headers with no exploit path, self-XSS).
• Vulnerabilities in third-party services outside our control.

4. Safe harbor

Construction OS will not pursue civil action or file a report with law enforcement for good-faith research conducted in accordance with this policy, provided you:

• only interact with accounts you own or have written permission to test;
• make a good-faith effort to avoid privacy violations, service degradation and data destruction;
• do not exfiltrate more data than necessary to demonstrate the issue;
• give Construction OS a reasonable opportunity to remediate before public disclosure.

5. Coordinated disclosure timeline

• Acknowledgement of your report: within 3 business days.
• Initial triage and severity assessment: within 10 business days.
• Remediation target: prioritised by severity.
• Coordinated public disclosure: up to 90 days from the report date, or sooner by mutual agreement.

6. Bounty

Construction OS does not currently operate a paid bug bounty programme. We publicly credit reporters (with permission) in a hall-of-fame page once an issue is remediated.