Security Policy | Octopus Scanner

Octopus Scanner is a free project maintained by one independent developer. Security reports are welcome and are taken seriously. This policy explains where to send them, what is covered and how to research the app responsibly.

1. Reporting a vulnerability

Report security issues privately by email to support@octopusscanner.com. Please do not post them publicly, for example in a forum, on social media or in a comment on the legacy itch.io page, until a fix is available.

You can also start an email from the app: in the footer of the scanning interface, select Options, then Report Bug, then Open email. This opens your own email client with nothing attached. Mention in the subject line that the report concerns security.

To help the issue be understood and reproduced, please include:

Affected platform: Whether the issue affects macOS, Windows, the HTML reports or this website, and the operating system you used.
Steps to reproduce: A clear, ordered description of how to trigger the issue, with any settings or test files needed.
Impact: What an attacker could achieve, and under what conditions.
Exploitation: Whether you know of the issue being exploited, or publicly discussed, already.

Do not include real personal data, client data, passwords or other credentials in your report. Use test accounts and test content instead. If you attach a file created with Export Bug Data or exported logs, review it first, because it may contain URLs you have scanned.

Please allow a reasonable amount of time for the issue to be investigated and fixed before you disclose it publicly. If you plan to publish your findings, say so in your report so that timing can be agreed.

2. What happens next

Octopus Scanner has a single maintainer and no dedicated security team, so no fixed response times can be guaranteed. The following describes what the project aims to do, in good faith.

Acknowledgement: The maintainer aims to acknowledge your report promptly and to tell you if more information is needed.
Investigation: The maintainer aims to confirm the issue, assess its impact and keep you informed of progress.
Fix: Confirmed issues in Octopus Scanner itself are fixed in a new release, and issues in the components it runs on are fixed through component updates. Each fix to the app is listed in the Release Notes.
Credit: If you would like to be credited, the maintainer aims to name you, or a handle you choose, alongside the fix. If you prefer to remain anonymous, you will not be named.

3. Scope

The following are in scope:

The Octopus Scanner app on macOS and Windows.
Its local scanning engine.
The HTML reports it produces.
This website.

The following are out of scope:

Third-party components themselves: Report vulnerabilities in components such as Google Chrome, Puppeteer, axe-core or Node.js to their own maintainers. If such a vulnerability affects Octopus Scanner, please also report it to support@octopusscanner.com.
Websites you scan: Issues in a website you scanned belong to that website's owner.
Social engineering: Attempts to deceive the maintainer or users are not accepted as research.
Denial-of-service testing: Do not attempt to overload this website or any other service.
Physical access: Findings that require physical access to an unlocked computer are not treated as vulnerabilities.

4. Good-faith research

If you research Octopus Scanner in good faith and in line with this policy, your report is treated as a contribution to the project and not as misuse. To stay within this policy:

Test only your own installation and your own data: Use a copy of Octopus Scanner installed on a computer you control, with test content you own.
Do not access other people's data: If you encounter data that is not yours, stop, do not keep or share it, and mention it in your report.
Do not scan websites without permission: Only scan websites you own or have explicit permission to test.
Do not degrade services: Do not disrupt this website, the websites you scan or any other service.

This policy does not change the Terms and Conditions. It does not permit anything the Terms prohibit, including reverse engineering, modifying the software or bypassing its integrity checks, except to the extent that applicable law allows. It also cannot give permission on behalf of anyone else, such as the owner of a website you scan.

5. How Octopus Scanner protects you

A full account of the measures and their limits is given in the Security section of Data, Privacy & Security. In summary:

Scans stay on your device: Scanning happens on your own machine, and no scan data is sent to the developer.
The local engine is not reachable from your network: It listens on this device's loopback address only, and requests must carry a secret generated each time the app starts.
Scanned pages are kept isolated: Chrome's sandbox and site isolation stay on in normal use, and file downloads from scanned pages are refused.
Nothing updates silently: The app verifies its own code before running it, and engine updates are verified and installed only with your consent.
Updates are signed: The release information the app reads before downloading an update is signed with the developer's private key, and the app checks that signature and the file's SHA-256 checksum before it opens anything.
Components are checked for known malware: Component Safety Check compares the components the scanner runs on against a public vulnerability database. It is on by default.

To confirm that a download is genuine, see Verify the file yourself in the Security Warnings Guide.

6. Known limitations

Octopus Scanner is not code-signed with a verified developer certificate and is not notarised by Apple, so Gatekeeper and Microsoft Defender SmartScreen warn you when you first open it. These warnings are expected and are not in themselves a vulnerability. The Security Warnings Guide explains why the app is unsigned and how to open it safely.

No software is free of flaws. The limits of each protective measure are stated in Data, Privacy & Security.