Security & Responsible Disclosure

1. Reporting a vulnerability #

Email support@odit.et with “Security” in the subject. Please include enough detail to reproduce the issue: the endpoint or screen, the request, what you expected, and what happened instead. A short proof of concept is worth more than a scanner report.

We will acknowledge your report within 3 working days and tell you whether we can reproduce it. We will keep you updated while we work on a fix, and we are happy to credit you publicly once it ships, if you would like that. We do not currently run a paid bug bounty.

Odit is a small team handling people’s financial data. We take reports seriously and would much rather hear from you than find out from our logs.

2. Scope #

In scope:

• odit.et, the web dashboard;
• sp.odit.et, the API the app and dashboard talk to;
• the com.robi.odit Android app.

Out of scope, and we would rather you did not spend time on them:

• Findings that only a scanner considers issues: missing headers, cookie flags, or version banners with no demonstrated impact;
• Denial of service, traffic floods, and anything that degrades the service for real users;
• Social engineering of our users or staff, and physical attacks;
• Reports about third-party services we depend on. Send those to the third party;
• Anything requiring a rooted device plus physical access to that same device.

3. Testing safely #

This is a live service holding real people’s bank messages. Two rules matter more than the rest:

• Use your own account and your own data. If you find a way to read another user’s records, stop at the point where you have proved it works. Do not enumerate, collect, or retain anyone else’s data, and tell us instead.
• Ask us before doing anything at volume. If your testing needs several accounts, load, or automated scanning, email us first and we will set you up with test accounts and a window. Bulk sign-ups and floods are indistinguishable from an attack from where we sit, and we will treat them as one.

Otherwise: do not modify or delete data that is not yours, do not persist access, and give us a reasonable chance to fix an issue before you publish it. Ninety days is a sensible default, and we will usually be much faster.

4. Safe harbour #

If you follow this policy in good faith, we will treat your research as authorised. We will not pursue legal action against you or ask anyone else to, and we will say so if a third party comes asking. If you are unsure whether something is allowed, ask first. A question costs us nothing and protects you.

This does not extend to accessing, downloading, or retaining other people’s data beyond the minimum needed to demonstrate a finding, and it does not override our obligations under Ethiopian law.

5. security.txt #

The machine-readable version of this contact information lives at /.well-known/security.txt, per RFC 9116.