Eagle Eyed

We work with security researchers to keep up with state-of-the-art web security. If you've discovered a security vulnerability that might impact our products, please let us know. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

1. Guidance & Rules

To encourage responsible disclosure, we promise not to initiate legal action against researchers who:

• Provide us with a reasonable amount of time to resolve the issue before making any information public.
• Avoid privacy violations, destruction of data, and interruption or degradation of our service (including DoS/DDoS).
• Do not access or modify data that does not belong to them.

2. Out of Scope

The following areas are generally excluded from our disclosure program:

• Social engineering (phishing) of Scouting Site staff or volunteers.
• Physical security attacks against our offices or OVHcloud data centers.
• Clickjacking on pages with no sensitive actions.
• Non-sensitive "Best Practice" findings (e.g., missing security headers without a proof-of-concept).

3. How to Report

Please send your findings to our security team via a High-Priority Support Ticket or email [email protected]. Include a clear Proof of Concept (PoC) and steps to reproduce the issue.