Security

01Reporting a vulnerability

If you believe you have found a security weakness in www.onboardforce.com or the OnBoard Force app, please tell us. Send your report through the contact page at onboardlogistics.net with the subject “Security — OnBoard Force”, or through your OnBoard Logistics contact.

Helpful reports include:

• the page, feature or URL affected;
• the steps to reproduce the issue;
• what an attacker could do with it;
• how we can reach you.

02Responsible disclosure

When you research or report a vulnerability, please:

• give us a reasonable time to fix the issue before you share it with anyone else;
• use only your own account or test data, and stop as soon as you reach information that isn't yours;
• not view, change, keep or delete other people's data beyond the minimum needed to show the issue;
• not run denial-of-service, spam, social-engineering or physical attacks, or automated scans that generate heavy traffic.

03What you can expect from us

We will acknowledge your report, keep you informed while we investigate and fix it, and tell you when it is resolved. We will not take legal action against research done in good faith that follows these guidelines. This is not a paid bug-bounty programme.

04How we protect the app

• Every connection is encrypted with HTTPS, enforced with HSTS.
• Accounts are created by administrators for OnBoard Logistics staff only; sign-in is protected against automated attacks and new passwords are checked against known breaches.
• Access is checked on the server for every request and scoped to each person's office and role.
• Customer quote pages use unique, hard-to-guess links, show only that customer's quote, and are excluded from search engines.
• The app's pages are excluded from search engines, and the site sends standard browser security headers.

A machine-readable version of this contact information is published at /.well-known/security.txt.