We want to hear about security problems in Orchard, and we would rather hear from you than read about it. This page says what to test, how to report it, what we will do, and the protection we give you for doing it in good faith.
Report to: security@entertheorchard.ai · machine-readable at /.well-known/security.txt
How to report
Email security@entertheorchard.ai with:
- what you found and where: the host, the URL or endpoint, the component and version;
- the steps to reproduce it, and a proof of concept if you have one;
- what an attacker could do with it, as you understand it;
- how to reach you, and the name you would like credited, if any.
Please do not put Orchard customer data in the report. If reproducing the issue showed you any, describe it rather than quoting it.
What we will do
- Acknowledge your report within 3 business days.
- Triage it within 10 business days: confirm whether we can reproduce it, how severe we judge it to be, and what happens next.
- Keep you informed while we fix it, and tell you when it is fixed.
- Agree a disclosure date with you, and credit you if you want to be credited.
We do not run a paid bounty programme at present.
In scope
- The Orchard platform: app.entertheorchard.ai (the console), api.entertheorchard.ai (the API) and admin.entertheorchard.ai (Orchard's internal console).
- The Orchard watcher, the endpoint agent for Windows and macOS, and the Orchard browser extension.
- The installer and update downloads on dl.entertheorchard.ai and updates.entertheorchard.ai.
- This website, entertheorchard.ai.
Of particular interest: anything that crosses a tenant boundary, bypasses authentication or multi-factor authentication, lets one workspace's endpoint act for another, or captures something Orchard says it excludes, such as a recognized password field.
Out of scope
- Services Orchard uses but does not run, such as Google Cloud, Cloudflare, Anthropic, Stripe, Resend or GitHub. Report those to the vendor.
- Denial of service, load testing, or anything that degrades the service for others.
- Social engineering, phishing, or physical attacks against Orchard staff, customers or offices.
- Spam, or findings that need a victim's unlocked device or an already compromised account.
- Automated scanner output without a demonstrated impact, and missing headers or best-practice settings with no exploitable consequence.
Rules of engagement
- Test only against an account and workspace you own. Do not access, change or delete data that is not yours, and stop as soon as you see any.
- Do not enroll an endpoint you do not own, or run the watcher on a machine without its user's knowledge.
- Do not keep, share or publish data you came across. Delete it once your report is filed.
- Keep the details confidential until the agreed disclosure date.
Safe harbor
If you make a good-faith effort to follow this policy, we will consider your research authorized. We will not pursue or support legal action against you, including under the Computer Fraud and Abuse Act, anti-circumvention law or our terms of service, for research that stays within it. If a third party brings action against you for activity that complied with this policy, we will make it known that your work was authorized.
If you are unsure whether something is in scope, or whether a test would be acceptable, ask us first at the same address.