Purpose
Airbooks Inc. operates OMEGA Markets and Airbooks. We welcome good-faith reports of security vulnerabilities that affect those services.
This policy describes how to report a vulnerability, what is in scope, and what you can expect from us. It is the vulnerability-disclosure policy referenced by our RFC 9116 security.txt files.
Safe harbor
If you make a good-faith effort to follow this policy, we will not pursue civil or criminal action or report you to law enforcement for that research. We consider research conducted under this policy to be authorized.
Safe harbor applies only to research that stays within the scope and rules below, uses the minimum access needed to demonstrate a finding, and is reported to us promptly.
Scope
In scope: the production OMEGA Markets service at core.omega-markets.com, the production Airbooks service at app.omega-markets.com, and the public APIs those hosts expose.
Out of scope: third-party services we use (including identity providers), social engineering of employees or customers, physical attacks, denial-of-service or volumetric testing, spam, and accessing or modifying another customer's data beyond the minimum needed to demonstrate a vulnerability.
How to report
Email security@omega-markets.com. That inbox is monitored by Airbooks.
Please include a description of the issue, the affected URL or endpoint, steps to reproduce, the potential impact, and any proof of concept you can share safely. Do not include other customers' data in the report if it can be avoided.
What to expect
We aim to acknowledge receipt within 3 business days and complete an initial triage within 10 business days. We will keep you informed of significant status changes.
Please give us a reasonable chance to remediate before public disclosure. Ninety days from the initial report is a typical window unless we agree otherwise.
Rules of engagement
Do not degrade availability, destroy data, or persist access after you have demonstrated the issue. Do not demand compensation as a condition of reporting.
We do not currently operate a public bug-bounty program. We may acknowledge researchers who report in-scope issues, with your permission.