Vulnerability Disclosure Policy

Last updated: October 19, 2026

Preneur LLC (“OKForest”, “we”) welcomes good-faith security research into our services and open-source software, and will work with you to understand, validate, and fix what you find. This page is the policy referenced by our security.txt (RFC 9116).

How to report

Email security@okforest.ai with:

  • the affected host, endpoint, package, or GitHub Action;
  • steps to reproduce (a proof of concept is ideal);
  • the impact you believe the issue has.

For the open-source repositories, you can instead use GitHub’s private vulnerability reporting: open the repository’s Security tab (for example, okforest/cli) and click Report a vulnerability.

Please don’t report anything sensitive in public GitHub issues, so a fix can ship before the details are public.

What to expect from us

  • We will acknowledge your report within 5 business days.
  • We will keep you informed as we validate and fix the issue.
  • We do not run a paid bug bounty program and do not offer monetary rewards. We are happy to credit you publicly for a valid report if you wish.

Scope

In scope:

Out of scope: reports of the following do not qualify unless you show a concrete security impact:

  • missing security headers, SPF, DKIM, or DMARC opinions, or other scanner output without a proof of concept;
  • clickjacking on pages with no sensitive actions;
  • software version disclosure;
  • denial of service, volumetric, or brute-force findings;
  • issues in third-party services we use (please report those to the vendor).

Rules of engagement

  • Test only with accounts and data you own; never access, change, or delete anyone else’s data. If you come across someone else’s data, stop and report it.
  • No denial-of-service testing, social engineering, phishing, or physical attacks.
  • Give us a reasonable window (90 days, or a date we agree on) to fix the issue before any public disclosure.

Safe harbor

We will not pursue legal action against you, or treat your research as a violation of our Terms of Service, for security research done in good faith and within this policy, including circumventing security measures as far as that research needs (the Terms’ acceptable use forbids it otherwise; this policy authorizes it for that research). This safe harbor does not cover actions outside this policy or research that affects third parties.