OSMSecurity
How to tell us about a security problem, how OSM is built to be safe, and every security advisory for OSM.
Report a problem
Found a weakness in OSM or in one of our services? Write to security@osm-os.com. This is the only way to report one. We answer within a week.
Tell us what you found, how to see it again, and what it could let someone do. Write in English, German or French.
What this covers
- OSM, the system on your server
- the account site,
account.osm-os.com - the service servers call for OSM Connect,
api.osm-os.com - the OSM Connect relay,
osm-relay.com - the update service,
updates.osm-os.com
An address under osm-relay.com leads to a customer's own server: test only your own.
Research in good faith
- Use only your own accounts and servers.
- Do not read, change or delete other people's data. If you reach some, stop and tell us.
- Do not slow our services down: no denial of service, no mass sign-in attempts.
- Tell us before anyone else, and give us time to fix the problem.
[the lawyer's text: what we promise people who research in good faith and keep to these rules]
How OSM is built to be safe
Updates signed by OSM and checked by every server, two-step sign-in, a firewall, and OSM Connect that our relay cannot read. The Security overview in the documentation explains each part.
Security advisories
Newest first. A server that is affected shows the advisory too, from its own signed update information.
No security advisory yet. When there is one, it is listed here, newest first, and every affected server shows it too.