1. How to report
E-mail security@ops2sell.com with what you found, the steps to reproduce it, and what an attacker could do with it. Screenshots or a short video help. English or Lithuanian is fine.
Please don't include real customer data in your report. If you accidentally saw any, tell us and delete it.
2. What happens next
- We confirm we've received your report within 3 working days.
- We tell you whether we can reproduce it and how serious we think it is.
- We keep you updated until it's fixed, and we'll credit you if you'd like.
3. In scope
- The Ops2Sell application at ops2sell.com, including its API
- The Ops2Sell Warehouse handset app
- The Ops2Sell connector file installed on customers' OpenCart shops
4. Please don't
- Access, change or delete data that isn't yours, beyond the minimum needed to show the problem
- Disrupt the service (no denial-of-service or load testing)
- Use phishing or social engineering against our staff or customers
- Test the services of our suppliers (hosting, e-mail, payment providers); report those to them directly
- Publish details before we've had a reasonable chance to fix the problem
5. Our promise
If you act in good faith and follow this page, we won't take legal action against you for your research, and we'll treat your report as help, not as an attack. We don't run a paid bug bounty at the moment.