Opttab takes the security of its systems seriously and appreciates reports from people who identify potential security vulnerabilities in Opttab systems. This policy explains how to report a suspected vulnerability and what we ask you to include so we can review and respond.

1. How to report

Send reports to: security@opttab.com

Please include at least:

a description of the suspected vulnerability and its potential impact;
steps to reproduce the issue; and
your contact information.

If available, also include supporting material such as screenshots, logs, proof-of-concept code, affected URLs or MCP endpoints, request and response samples, and suggested remediation.

Write in English or Dutch. Reports go directly to security@opttab.com.

We aim to acknowledge reports within 5 business days and to keep you informed of our progress.

2. Scope

This policy covers suspected vulnerabilities in:

opttab.com and its subdomains (*.opttab.com), including the Opttab platform (app.opttab.com);
Opttab remote MCP servers (mcp.opttab.com);
Opttab APIs; and
Opttab-published ChatGPT apps, Claude connectors and on-site shopping agent scripts, to the extent the issue lies in Opttab's code or configuration.

Reports about third-party products, services or infrastructure that Opttab does not control are out of scope, unless the issue is caused by Opttab's own code, configuration or implementation. Brand Agents run on behalf of our customers: test only an agent or workspace you own, and never place real orders or trigger actions against a customer's systems.

Of particular interest: authentication and authorization flaws, cross-workspace data access, exposure of customer credentials or tokens, prompt injection that causes an agent to perform unauthorized actions or leak data across tenants, server-side request forgery, and remote code execution.

3. Out of scope

Social engineering, phishing or impersonation of Opttab staff or customers.
Physical security issues.
Denial-of-service or distributed denial-of-service activity.
Spam, brute force, credential stuffing or automated volumetric attacks.
Malware, ransomware or destructive payloads.
Issues that only involve third-party services not owned or controlled by Opttab.
AI model output that is merely inaccurate, offensive or "jailbroken" without a security impact on Opttab or its customers.
Missing best-practice headers, SPF/DMARC configuration, clickjacking on pages without sensitive actions, or software version disclosure, without a demonstrated exploit.
Reports without enough detail to reproduce or evaluate the issue.

4. What we ask of you

Act in good faith.
Provide accurate and complete information.
Do not disrupt, degrade or impair Opttab systems or services.
Do not access, use, modify, disclose or delete data that does not belong to you. If you encounter such data, stop, do not keep it, and tell us.
Use only test accounts you own, and do not interact with customers' agents, End Customers or connected systems.
Report privately to Opttab and give us a reasonable opportunity to investigate and fix the issue before any public disclosure.

5. No commitment to compensation

Opttab may, at its sole discretion, recognize or reward certain valid reports. We are under no obligation to provide compensation, and any decision on whether to provide it, and in what amount, is ours alone. Rewards are not available where prohibited by law or sanctions rules.

6. Safe harbor

If you make a good-faith effort to comply with this policy while identifying and reporting a suspected vulnerability, Opttab will not initiate legal action against you or report you to law enforcement based solely on your participation in this process. This statement is made in line with the Dutch Public Prosecution Service's guidance on coordinated vulnerability disclosure.

This safe harbor applies only if your activities:

are limited to assets in scope under this policy;
comply with the rules in this policy;
do not involve accessing, using, modifying, disclosing or deleting data that does not belong to you;
do not disrupt, degrade or impair Opttab systems or services; and
are reported promptly and privately to security@opttab.com.

It does not apply to conduct outside the scope of this policy, conduct that harms Opttab, its customers or any third party, conduct involving third-party systems or data, or conduct that otherwise breaks the law. We cannot authorize testing on behalf of third parties, including our customers or AI platforms. Opttab reserves all rights for conduct outside the scope of this policy.

7. Public disclosure

Please do not publicly disclose a suspected vulnerability until Opttab has had a reasonable opportunity to investigate and address it. We are happy to agree a disclosure date with you and, if you wish, credit you.

8. Reservation of rights

Opttab decides, at its sole discretion, whether a reported issue is a security vulnerability, whether it is in scope, what action to take, and whether to offer recognition or compensation. We may change this policy at any time.

9. Personal data

We use the personal data in your report only to handle it, as described in our Privacy Policy.

10. Contact

Questions about this policy: security@opttab.com.