Vulnerability Disclosure Policy
Last updated: October 16, 2026
Introduction
We’re building Omnea with security in mind. The protection of our systems and customer data is a priority for us. As we evolve there may be bugs or misconfigurations and we appreciate the role that security researchers can play in helping us to prioritise this protection.
This policy applies to any vulnerabilities you are considering reporting to us so please read it in full before you report a vulnerability and always act in compliance with it.
This vulnerability disclosure policy sets out the scope of this policy, how to contact us, what to expect when disclosing vulnerabilities to us, and further guidance. It is intended to be aligned and compatible with common vulnerability disclosure good practice.
If you make a good faith effort to comply with this policy during your security research we will consider your research to be authorised, we will work with you to understand and resolve any issues that you find promptly, and we will not recommend or pursue legal action related to your actions. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause Omnea our partner organisations to be in breach of any legal obligations.
Scope
Please respect the following scope and guidelines of our vulnerability disclosure policy.
Inclusions
This policy applies to our websites, platforms and apps as follows:
Domain: *.omnea.co
Exclusions
There are no domains that are explicitly out of scope of this policy at this time.
Guidelines
Please do…
Maintain contact with us throughout the process.
Respect data protection rules and the privacy of individuals in any data you access.
Securely delete any and all data that you may retrieve once it is no longer required and no longer than 1 month of the vulnerability being resolved.
Please do not…
break any applicable law or regulation.
use social engineering techniques against our customers or staff.
access unnecessary, excessive or significant amounts of data.
modify or delete any data within our systems or services.
share or redistribute any data from our systems or services.
attempt, conduct or report any ‘denial of service’ conditions, such as overwhelming a service with a high volume of requests.
submit reports detailing non-exploitable vulnerabilities, or reports indicating that the services do not fully align with “best practice”, for example missing security headers.
submit reports detailing TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS1.0 support.
demand financial compensation in order to disclose any vulnerabilities.
Reporting
If you believe you have found a security vulnerability relating to our systems please submit a vulnerability report via: https://omnea.co/contact
Please include the following information in your report:
Include the words “Vulnerability Disclosure Report” at the top of your message.
The URL, IP address or domain where the vulnerability can be found. If the same vulnerability exists on multiple systems, please list them all on the same report.
A brief description of the type of vulnerability (such as “”)
The steps that can be taken to reproduce the vulnerability, so that we can effectively and efficiently triage your report.
What to expect
Your report will be reviewed and validated by a member of the Omnea team and we aim to respond to your report within 5 working days and have it triaged within 10 working days.
If we receive multiple reports of the same issue we will treat subsequent submissions as duplicates of the earliest report.
We aim to keep you informed of our progress as we go. You are welcome to request status updates from time to time, however please avoid doing so more than every 14 days so that our team can focus on triaging and remediating your findings.
We do not offer monetary rewards for vulnerability disclosure, however we will publicly disclose remediated vulnerabilities and give credit to those who submit them on this page.
We welcome disclosure requests for remediated issues and the opportunity to coordinate our public release.
![](data:image/svg+xml,<svg display="block" id="3072597479" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><g fill="transparent" height="16.000200226623406px" id="GTQWvJ6mq" width="15.99990004043579px"><path d="M 3.343 0 L 0 0 L 0 10.661 L 3.343 10.661 Z" fill="rgb(115, 112, 108)" height="10.661279999999998px" id="LoeK6pYtS" transform="translate(0.27 5.262)" width="3.3432189999999995px"/><path d="M 7.025 0.035 C 6.902 0.019 6.771 0.012 6.64 0.004 C 4.768 -0.073 3.713 1.036 3.343 1.514 C 3.243 1.645 3.197 1.722 3.197 1.722 L 3.197 0.297 L 0 0.297 L 0 10.958 L 3.197 10.958 L 3.343 10.958 C 3.343 9.872 3.343 8.793 3.343 7.707 C 3.343 7.122 3.343 6.536 3.343 5.951 C 3.343 5.227 3.289 4.456 3.651 3.794 C 3.959 3.239 4.514 2.962 5.138 2.962 C 6.987 2.962 7.025 4.633 7.025 4.788 C 7.025 4.795 7.025 4.803 7.025 4.803 L 7.025 11.004 L 10.369 11.004 L 10.369 4.048 C 10.369 1.668 9.159 0.266 7.025 0.035 Z" fill="rgb(115, 112, 108)" height="11.004105999786248px" id="I8ZK_lI2U" transform="translate(5.631 4.996)" width="10.368549999999999px"/><path d="M 1.941 3.882 C 3.013 3.882 3.882 3.013 3.882 1.941 C 3.882 0.869 3.013 0 1.941 0 C 0.869 0 0 0.869 0 1.941 C 0 3.013 0.869 3.882 1.941 3.882 Z" fill="rgb(115, 112, 108)" height="3.8824500000000315px" id="BoA0OppHn" width="3.882450000000003px"/></g></svg>)
![](data:image/svg+xml,<svg display="block" id="4174065905" role="presentation" viewBox="0 0 16 16" xmlns="http://www.w3.org/2000/svg"><path d="M 12.903 0 C 14.613 0 16 1.289 16 2.88 L 16 9.119 C 16 10.71 14.613 12 12.903 12 L 3.097 12 C 1.387 12 0 10.71 0 9.119 L 0 2.88 C 0 1.289 1.387 0 3.097 0 Z M 6.092 8.911 L 11.521 6 L 6.092 3.089 Z" fill="rgb(115, 112, 108)" height="12px" id="Gnx304Rz4" transform="translate(0 2.5)" width="16px"/></svg>)