Security

Reporting a vulnerability

If you believe you have found a security issue affecting open-telemetry.net, write to [email protected]. Please include the affected URL or endpoint, steps to reproduce and the impact you observed. Encrypted reports are welcome on request.

What to expect

We acknowledge reports within 3 working days, give a first assessment within 10 working days and keep you informed until the issue is resolved. We will credit reporters who wish to be named once the fix is released.

Scope

In scope: open-telemetry.net, cdn.open-telemetry.net and api.open-telemetry.net. Out of scope: denial-of-service testing, social engineering of staff or customers, physical attacks, and any third-party service.

Good-faith research

We will not pursue legal action against researchers who act in good faith: access only the data needed to demonstrate the issue, do not degrade the service, do not disclose details before a fix is available, and stop and report if you encounter personal data.

Machine-readable policy

See /.well-known/security.txt.