Report a security problem

Last updated September 28, 2026. Sphere maintains this policy.

On this pageHow to report

Found a security problem in CondoOS? Tell us privately and give us time to fix it. We won’t pursue good-faith research that follows this policy.

01How to report

Email info@sphereinc.com with “Security” in the subject and what you found, how to reproduce it, and what an attacker could do with it. Screenshots, requests and responses help. Please don’t put an owner’s personal information in the report.

Our /.well-known/security.txt lists the same address.

02What is in scope

This site, condoos.sphereinc.com, including the free Compliance Check.
The CondoOS console, owner portal and API at app.condoos.sphereinc.com.
Association websites hosted by CondoOS.

03What is out of scope

Denial of service, load or volume testing, and spam.
Social engineering of Sphere staff, associations, managers or owners, and physical attacks.
Services we use but don’t run, such as Amazon Web Services. Report those to their owners.
Reports from automated scanners with no shown impact.

04Safe harbour

If you act in good faith and follow this policy, we won’t take legal action against you or ask anyone else to, and we’ll treat your research as authorised. In return:

Use only accounts you own or test accounts we give you. Never open, change or delete another association’s or owner’s records.
If you reach personal information, stop, don’t keep it, and tell us.
Give us time to fix the problem before you tell anyone else: 90 days, unless we agree otherwise.

05Response times

StepWhen

We confirm we have your reportWithin 2 working days

We tell you how serious we think it isWithin 5 working days

We fix it, by severityCritical within 7 days, high within 30, medium and low within 90

We tell you it’s fixedWhen the fix is live. We credit you if you’d like

06Recognition

We’ll credit you publicly if you’d like. We don’t run a paid bounty programme.