Onapsis Vulnerability Disclosure

generated: '2026-08-04'
method: searched
probe: true
source: https://onapsis.com/security-vulnerability-reporting-guidelines/
description: >-
  Onapsis publishes two distinct, separate disclosure documents. The inbound
  policy — "Security Vulnerability Reporting Guidelines" — governs reports about
  Onapsis's own products and web properties. The outbound policy — the Onapsis
  Research Labs "Disclosure Policy" — governs how Onapsis reports vulnerabilities
  it finds in third-party vendor software (SAP, Oracle) and when it publishes an
  advisory. Both are public and were fetched at HTTP 200. The automated probe
  recorded neither because Onapsis serves no /.well-known/security.txt (404) and
  hosts its inbound policy at a non-standard path; this is the searched,
  human-verified fill.
policy:
- https://onapsis.com/security-vulnerability-reporting-guidelines/
- https://onapsis.com/disclosure-policy/
contact:
- https://onapsis.com/security-vulnerability-reporting-guidelines/
- https://onapsis.com/customer-portal/
contact_note: >-
  The reporting guidelines publish a security team email address, but it is
  rendered through Cloudflare email obfuscation and is not present in the served
  HTML, so no address is recorded here rather than guessed. Customers and
  partners are directed to file a service request through the Customer Portal;
  non-customers are directed to the (obfuscated) security email. PGP encryption
  is offered via a linked security key.
inbound_policy:
  url: https://onapsis.com/security-vulnerability-reporting-guidelines/
  scope:
  - Onapsis products and platforms (OP, CP)
  - onapsis.com website
  out_of_scope:
  - Vulnerabilities in older application/package/library versions
  - Security-header-related issues
  - Transport Layer Security configuration issues
  - Brute force attacks
  - Attacks that require social engineering
  required_information:
  - Affected product and version
  - Vulnerability description with impact analysis
  - Prerequisites for exploitation
  - Proof-of-concept or relevant logs
  good_faith_clause: >-
    Researchers are asked to make a good faith effort to avoid privacy
    violations, destruction of data, and interruption of Onapsis products.
  bug_bounty: false
  bug_bounty_note: No bug bounty program is mentioned in the policy.
  response_timeline: >-
    Onapsis states it will keep the reporter updated on status during the
    evaluation process; no fixed SLA is published.
  pgp:
    offered: true
    key_url: null
    note: >-
      The page links a security key at /pgp/security.asc, but that path returns
      the WordPress HTML catch-all (HTTP 200, text/html) rather than an ASCII-
      armored key, so no key is captured.
outbound_policy:
  url: https://onapsis.com/disclosure-policy/
  owner: Onapsis Research Labs
  vendor_response_window_days: 21
  vendor_fix_window_days: 45
  status_check_cadence: monthly, with two 14-day follow-up periods before publication
  maximum_disclosure_window_months: 12
  publication:
  - https://onapsis.com/security-advisories/
  - https://github.com/Onapsis/vulnerability_advisories
evidence:
- source: https://onapsis.com/security-vulnerability-reporting-guidelines/
  kind: inbound vulnerability reporting policy
  http_status: 200
- source: https://onapsis.com/disclosure-policy/
  kind: coordinated disclosure policy (outbound, Research Labs)
  http_status: 200
- source: https://onapsis.com/security-advisories/
  kind: published advisory index
  http_status: 200
- source: https://onapsis.com/.well-known/security.txt
  kind: RFC 9116 security.txt
  http_status: 404
- source: https://onapsis.com/pgp/security.asc
  kind: PGP key (HTML catch-all, not a key)
  http_status: 200