1. How to report
Email security@onehop.network with what you found, the steps to reproduce it, and the impact you think it has. Screenshots, request/response pairs or a short proof of concept help us move fast. If you would like to encrypt your report, say so in a first message and we will arrange it.
Please report privately and give us a reasonable time to fix the issue before telling anyone else. We will agree a disclosure date with you, normally within 90 days of your report.
2. What is in scope
- The OneHop web app and API on
onehop.networkand its subdomains. - Public contact cards (
/g/…), community invite and join links, event passes. - The OneHop AI connector (MCP and OAuth endpoints) and the phone and Mac companions.
Out of scope:
- Third-party services we use (our hosting, database, email and payment providers) — report those to the vendor.
- Denial-of-service, load or volumetric testing, and spam or social-engineering of our staff or members.
- Physical attacks, and findings that need a compromised device or browser.
- Missing best-practice headers or banner/version disclosure with no demonstrated impact.
3. Rules for testing
- Use only accounts you own or have permission to use. Never access, change or delete another person’s data.
- If you reach personal information by accident, stop, don’t keep a copy, and tell us in your report.
- Don’t degrade the service for others; no automated scanning at a rate that affects members.
- Don’t exploit a finding beyond what is needed to show it exists.
4. Safe harbour
If you follow this policy in good faith, we will not take legal action against you or ask anyone else to, and we will treat your research as authorised. If a third party brings action against you for research that followed this policy, we will make it known that you acted with our authorisation. If you are unsure whether something is allowed, ask us first at security@onehop.network.
5. What happens next
| Step | When |
|---|---|
| We acknowledge your report | Within 3 business days |
| We triage it and tell you how serious we think it is | Within 10 business days |
| We fix it | As fast as the severity needs; we keep you updated at least every 2 weeks |
| We credit you (if you want) | Once the fix is live |
We don’t run a paid bug bounty yet. We are happy to thank researchers publicly on this page with their permission.