If you found something, tell us.
We treat outside scrutiny as a contribution, not a threat. The security page says it; this page is the mechanism.
In scope.
Three surfaces, all of them ours. If it runs Oculon code, it belongs here.
What to send.
Four parts, no template required. The difference between a report we act on that day and one we spend a week reconstructing is usually the second item.
A description
What the issue is, and where it lives, the page, the component, the behavior.
Reproduction steps
Numbered, specific, start to finish. If we can't reproduce it, we can't fix it.
An impact assessment
What could go wrong, and for whom. Your read on severity helps us triage. We'll form our own too.
A way to reach you
For follow-up, and for credit if you'd like it. An anonymous account works if you'd rather not.
What happens after you hit send, stated as commitments, not aspirations.
Our side of it.
To acknowledge your report, with a named person attached to it.
Status updates as the work happens, not just when it's finished.
Named on this page's history, or fully anonymous. Your call.
Research done in good faith isn't a violation of anything. We ask one thing in return: a reasonable window to fix it before publication.
Out of scope.
Where it goes.
One address, read by the engineers who can act on it. Not a ticket queue. Two business days, a named person, and our thanks.