Report security problems safely and directly.

In scope: opencasemanagement.com, demo.opencasemanagement.com, current Metatheria-hosted OCM deployments where you have an authorized account, the public OCM source repository, and official OCM mobile apps. Customer systems not hosted by Metatheria, customer-created content, and third-party services are out of scope unless the issue originates in OCM code or our configuration.

• Use only accounts and data you own or have explicit permission to test.
• Stop when you confirm a vulnerability. Do not access, alter, download, retain, or disclose more data than necessary.
• Do not use denial of service, destructive testing, malware, spam, social engineering, physical attacks, credential stuffing, or persistence.
• Do not test production customer tenants without that customer’s and Metatheria’s advance written authorization.
• Protect any inadvertently encountered information, delete local copies after reporting, and allow a reasonable remediation period before disclosure.

Email alex@clarkmanagementconsulting.comwith the affected URL, version or commit, impact, reproducible steps, prerequisites, proof of concept, and safe contact information. Do not send live credentials, client information, or a large data sample. If sensitive transmission is necessary, request a secure channel first.

We aim to acknowledge a report within three business days, provide an initial assessment within ten business days, and communicate material status changes. These are targets, not service-level guarantees. We prefer coordinated disclosure after remediation and will discuss timing and credit with the reporter.

If you make a good-faith effort to comply with this policy, we will treat the research as authorized under the Computer Fraud and Abuse Act and similar laws, will not pursue legal action for accidental, good-faith violations, and will work with you to clarify concerns. It does not bind our customers or any other third party, excuse privacy or confidentiality violations, authorize conduct outside scope, or waive rights concerning extortion, threats, or intentional harm.