Report a security vulnerability

If you find a vulnerability in our products or a website we operate, please report it confidentially to our security contact.

Report to: security@origsmart.com

What to include

• The affected product, device or website, its version and, if known, the firmware version or affected URL.
• Steps to reproduce the issue and the conditions under which you observed it.
• The potential security impact and observed result, supported where possible by evidence without personal data.
• A way to contact you for clarification.

Do not send passwords, access tokens or unnecessary personal data. Before sharing sensitive attachments or large datasets, email us to agree a secure transfer method.

Acknowledgement and investigation

We will acknowledge receipt within five working days. We may request further details and discuss the next steps for investigation and remediation. The five-day commitment concerns acknowledgement; remediation time depends on the nature of the issue.

Coordinated disclosure

Please do not publish details that enable exploitation until a fix is available. We will coordinate the timing and content of disclosure with you. After remediation, we will acknowledge your contribution on request, using a name you approve.

Good-faith security research

We will not initiate legal action over good-faith security research conducted in accordance with these principles. Limit testing to what is necessary to demonstrate the issue: do not disrupt services, modify or delete other people’s data, access unnecessary personal data, or use social engineering or physical intrusion.

If you encounter sensitive data, stop that part of your testing and notify us; do not share the data further. We do not authorise testing of third-party systems and cannot make legal commitments on behalf of third parties.