Responsible Disclosure Policy

People trust OpenAccess with sensitive information. If you find a security vulnerability, please tell us privately so we can fix it before anyone is harmed.

• Email admin@thinkroman.com with the subject “Security report”.
• Describe the issue, the steps to reproduce it and its likely impact.
• Include your contact details if you would like us to follow up.

• Use only test accounts you create yourself.
• Stop as soon as you confirm an issue, and report it straight away.
• Give us reasonable time to fix it before telling anyone else.

• Access, change or keep anyone else’s data.
• Disrupt the service, or run denial-of-service or spam tests.
• Use social engineering, phishing or physical attacks.
• Contact our clients or Providers about the issue.

• We will acknowledge your report within 3 working days.
• We will keep you updated while we investigate and fix it.
• We will not take legal action against research carried out in good faith under this policy.
• With your permission, we will thank you publicly once the issue is fixed.

• Reports from automated scanners without a demonstrated impact.
• Missing best-practice headers with no exploitable issue.
• Issues in third-party services we use; please report those to the provider.