Ossprey

About

Use Cases

Our Platform

Blog

Contact

Ossprey
Ossprey

Responsible disclosure

Ossprey Responsible Disclosure

Ossprey Responsible Disclosure

Ossprey Responsible Disclosure

At Ossprey we build tools that detect and stop malware in open source code, so security matters deeply to us. If you come across a security issue in the course of normal use of our platform, website, or open source repositories, we would be grateful if you let us know.

At Ossprey we build tools that detect and stop malware in open source code, so security matters deeply to us. If you come across a security issue in the course of normal use of our platform, website, or open source repositories, we would be grateful if you let us know.

Report privately: security@ossprey.com

Report privately: security@ossprey.com

What we ask of you

What we ask of you

What we ask of you

Report any vulnerability you find privately by emailing security@ossprey.com before sharing it publicly. Give us enough detail to reproduce the issue, ideally including steps, affected endpoints or repositories, and any proof of concept. Please give us reasonable time to investigate and fix the problem before disclosing it elsewhere.

Report any vulnerability you find privately by emailing security@ossprey.com before sharing it publicly. Give us enough detail to reproduce the issue, ideally including steps, affected endpoints or repositories, and any proof of concept. Please give us reasonable time to investigate and fix the problem before disclosing it elsewhere.

How to report

Email security@ossprey.com with enough detail for us to understand and reproduce the issue. Please give us reasonable time to investigate and address it before sharing it publicly, and do not exploit the issue beyond what is needed to demonstrate it exists.

Scope

Scope

Scope

This policy covers accidental discoveries in our production platform, our public website, and our open source repositories at github.com/ossprey. It does not grant permission to conduct active testing against any Ossprey system. Third party services we rely on are out of scope and should be reported to their respective owners.

A thank you

We are an early stage company and cannot offer cash rewards. For valid, previously unreported issues we are happy to offer our thanks, public credit if you would like it, and Ossprey swag.

We are an early stage company and cannot offer cash rewards. For valid, previously unreported issues we are happy to offer our thanks, public credit if you would like it, and Ossprey swag.

Found something? Tell us privately first.

Found something? Tell us privately first.

Email security

Email security

Ossprey

© 2026. All rights reserved.

About

Use Cases

Our Platform

Blog

Contacts

Privacy Policy

Terms and Conditions of Use

Data Processing Agreement

Trust Center

Cookie Preferences