# Security Policy

Last updated October 27, 2026.

> [!SUMMARY] If you find a security problem, tell us privately and we'll fix it. Off the Clock asks your account for narrow permissions, keeps no passwords, and only lets members read a space.

## 1. Reporting a vulnerability

If you think you've found a security problem in Off the Clock, message **@ngerakines.me** on Bluesky and ask for a private way to send the details. Please include what you found, where, the steps to reproduce it, and what an attacker could do with it. Please don't post about it publicly before it's fixed.

We'll acknowledge your report within **3 business days**, keep you updated while we work on it, and tell anyone whose data was affected. We don't pay bug bounties, but with your permission we'll thank you by name once it's fixed.

## 2. What's in scope

**Please report problems with:**

- `off-the-clock.us` and its subdomains, including `api.off-the-clock.us`, `feeds.off-the-clock.us`, `docs.off-the-clock.us` and `policies.off-the-clock.us`;
- signing in, sessions, and the permissions Off the Clock asks for;
- anything that lets someone read a space they aren't a member of, write into one, or act as someone else; and
- the admin pages and the community identity's records.

**Please report these elsewhere:**

- problems with your own account or provider (Bluesky, another PDS) to that provider;
- problems with [Highport](https://highport.space/), which serves our policies and docs sites, under [its policies](https://policies.highport.space/security/); and
- problems with Railway, Cohere, or other providers to them.

If you're not sure where something belongs, send it to us.

## 3. Good-faith research

We won't take action against research that stays within these rules: test only with your own account and spaces you're a member of, don't read or keep other members' data, don't disrupt the service, and give us reasonable time to fix a problem before you talk about it.

## 4. How Off the Clock protects spaces

- **No passwords.** You sign in through your own provider; Off the Clock never sees your password.
- **Narrow permissions.** Off the Clock asks your account only for what it uses, listed in our [docs](https://docs.off-the-clock.us/members/permissions/). Admins approve extra permissions separately.
- **Members only.** The community's PDS asks Off the Clock's index who may read and write each space every time it hands out access, and the answer comes from the community's membership records.
- **Encrypted sessions.** Sign-in sessions are stored encrypted, and cookies can't be read by scripts.
- **Signed links.** Pictures are served from signed links that expire, so a copied picture link stops working. Calendar subscription links are signed and private to each member.
- **Encrypted connections** everywhere, and secrets never written to logs.

## 5. Protecting your own account

Your Off the Clock membership is only as safe as the account you sign in with. Use a strong, unique password with your provider, turn on two-factor sign-in if your provider offers it, and review the apps you've authorized from time to time. If you think someone else has used your account here, tell an admin.