OwlASO security

Reporting a vulnerability

Report privately through a GitHub Security Advisory on the affected repository (Security → Report a vulnerability, or the cards above). Please don’t open a public issue, pull request or discussion for a security problem.

A good report includes:

• The affected repository and version, tag or commit.
• Your environment: OS, Node.js version, desktop or web mode, MCP client.
• Step-by-step reproduction and a minimal proof of concept.
• The impact: what an attacker gains and what they need first.

Not sure which repository it belongs to? File it on owlaso/owlaso and we’ll move it.

In-scope targets

Only the following repositories, and the artifacts built from them, are in scope.

GitHub Actions workflows and repository configuration in these three repos are in scope too (e.g. workflow injection, leaked secrets).

Supported versions

What we look for

Issues with real impact on OwlASO users, for example:

• Remote or local code execution, including Electron sandbox or context-isolation escapes.
• Bypassing the local API’s Host allowlist, cross-site (CSRF) checks or DNS-rebinding protection.
• Path traversal or arbitrary file read/write (static files, rank history, exports).
• CSV/formula injection that survives export sanitising, with a demonstrated exploit.
• Breaking out of the app’s navigation, link or permission lockdown.
• MCP server: reaching a non-loopback backend, request smuggling through tool arguments, redirect following, or injecting frames into the stdio transport.
• Installer: command injection, or clobbering or leaking MCP client config.
• XSS or content injection on owlaso.github.io.
• CI/CD: GitHub Actions injection, secret exposure, or tampering with release artifacts.

Out of scope

When reporting vulnerabilities, please consider the attack scenario, exploitability, and security impact of the bug.

Vulnerability types

The following types of vulnerabilities are out of scope:

• Phishing
• Social engineering
• Physical security assessments
• Any form of denial of service (DoS) attack

Issues

The following issues are out of scope:

• Clickjacking on pages with no sensitive actions
• Authentication logic, flows and control mechanisms
• Cross-Site Request Forgery on unauthenticated forms or forms with no sensitive actions
• Attacks requiring MITM or physical access to a user’s device
• Previously known vulnerable libraries without a working PoC
• Comma Separated Values (CSV) injection without demonstrating a vulnerability
• Missing best practices in SSL/TLS configuration
• Any activity by a security researcher that could lead to the disruption of our service
• Content spoofing and text injection issues without showing an attack vector or without being able to modify HTML/CSS
• Rate limiting or brute-force issues
• Missing best practices in Content Security Policy
• Missing HttpOnly or Secure flags on cookies
• Missing email best practices (invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
• Vulnerabilities only affecting users of outdated or unpatched browsers, i.e. less than 2 stable versions behind the latest released stable version
• Software version disclosure, banner identification issues, descriptive error messages or headers (e.g. stack traces, application or server errors)
• Public zero-day vulnerabilities that have had an official patch for less than 1 month (recognized case by case)
• Tabnabbing
• Open redirect, unless an additional security impact can be demonstrated
• Issues that require unlikely user interaction
• Sessions not invalidated or devices not unlinked after password change
• Copy/pasted tool output (e.g. WPScan results, SSL Labs links) as a report. A PoC and a detailed description of how it affects a user’s data or OwlASO’s code or infrastructure must be included to be a valid finding, and is recognized case by case
• Pursuing vulnerabilities that send unsolicited bulk messages (spam) or unauthorized messages
• Arbitrary file download

OwlASO-specific

• Third-party services: Apple, Google Play, Meta Graph API, flagcdn.com, GitHub itself, and badge or font providers. Report those to their owners.
• Inaccurate or malicious data coming from the stores, including prompt injection in app listings or reviews passed to an AI client through the MCP server.
• Setups we document as unsafe, such as running web mode with HOST=0.0.0.0 on an untrusted network, or pointing OWLASO_URL at a backend you don’t control.
• Attacks that need an already compromised machine or a malicious local user with your privileges.

Rules of engagement

• Test against your own install or a local checkout. MOCK_STORE_DATA=1 runs OwlASO without hitting the real stores.
• Don’t access, change or delete other people’s data, and don’t degrade owlaso.github.io or GitHub.
• Don’t send large volumes of traffic to Apple or Google through OwlASO.
• Keep the details private until a fix is released or we agree on disclosure.

Disclosure process

1. Acknowledge: we aim to reply within 3 business days.
2. Triage: we confirm the issue, assess severity and keep you posted in the advisory thread.
3. Fix: we patch the supported versions and request a CVE where it applies.
4. Publish: the advisory goes public when the fix ships, within 90 days of the report unless we agree otherwise.

OwlASO is a free, open-source project with no paid bug bounty. With your permission, we credit reporters in the published advisory.

Safe harbor

We consider good-faith research that follows this policy to be authorized. We won’t pursue or support legal action against you for it. If you’re unsure whether something is allowed, ask in a private advisory before you test.