The Hyland OpenArch team takes the security of our software seriously. We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

The latest version is supported.

Please do NOT report security vulnerabilities in public.

To report a security vulnerability, please use our HackerOne reporting platform. All vulnerability reports will be handled according to Hyland's guidelines.

1. Acknowledgment

• We confirm receipt of your report
• We may ask clarifying questions

2. Validation

• We reproduce the issue
• We assess the severity and impact
• We determine affected versions

3. Development

• We develop a fix
• We create test cases
• We validate the fix internally

4. Disclosure

• We coordinate with you on disclosure timing
• We prepare a security advisory
• We release the fix

5. Public Disclosure

• We publish a security advisory
• We credit you (if you wish)
• We notify affected users

We follow responsible disclosure practices:

• We will keep you informed throughout the process
• We will credit you in the security advisory (if you wish)
• We will work with you on the disclosure timeline
• We will not take legal action against security researchers who:
  • Act in good faith
  • Follow this policy
  • Do not compromise user data or privacy

Please allow us:

• Adequate time to fix the vulnerability before public disclosure
• The opportunity to coordinate on disclosure timing
• The ability to prepare mitigations and user notifications

• 90 days: Standard disclosure timeline after initial report
• Shorter: For critical vulnerabilities actively exploited
• Longer: By mutual agreement for complex issues

Security vulnerabilities in:

• Hyland OpenArch core code
• Official Hyland OpenArch extensions and plugins
• Official Hyland OpenArch Docker images
• Hyland OpenArch REST APIs
• Hyland OpenArch authentication and authorization
• Hyland OpenArch data handling and storage

The following are generally NOT considered security vulnerabilities:

• Issues in third-party dependencies (please report them to the dependency maintainer)
• Social engineering attacks
• Denial of service requiring excessive resources
• Issues requiring physical access to the server
• Vulnerabilities in outdated/unsupported versions
• Issues already known and documented
• Theoretical vulnerabilities without proof of concept

When testing for vulnerabilities, please:

• DO: Use your own test instances
• DO: Stop when you've proven the vulnerability exists
• DO: Respect rate limits and system resources
• DO: Clean up after testing (remove test data, accounts, etc.)
• DON'T: Test against production systems you don't own
• DON'T: Access, modify, or delete data belonging to others
• DON'T: Perform attacks that could harm availability
• DON'T: Use automated scanners without permission
• DON'T: Exploit a vulnerability beyond demonstrating it exists

While using Hyland OpenArch, we recommend:

• Keep Hyland OpenArch updated to the latest stable version
• Use strong, unique passwords for all accounts
• Enable HTTPS/TLS for all communications
• Regularly backup your data
• Monitor logs for suspicious activity
• Apply the principle of least privilege
• Keep underlying infrastructure updated (OS, Java, database)

• Review and harden default configurations
• Disable unnecessary features and endpoints
• Use environment variables for secrets (never hardcode)
• Enable audit logging
• Configure appropriate rate limiting
• Use a Web Application Firewall (WAF) where appropriate

Follow secure coding practices

• Validate and sanitize all inputs
• Use parameterized queries (prevent SQL injection)
• Implement proper authentication and authorization
• Handle errors securely (don't expose sensitive info)
• Keep dependencies updated

We publish security advisories for all resolved vulnerabilities:

• GitHub Security Advisories

Each advisory includes:

• CVE Identifier: When applicable
• Severity Rating: Using CVSS score
• Affected Versions: Which versions are vulnerable
• Description: What the vulnerability allows
• Fixed Versions: Which versions contain the fix
• Workarounds: Temporary mitigations (if available)
• Credits: Recognition of the reporter

To receive security notifications:

• GitHub: Click "Watch" → "Custom" → "Security alerts" on our repository

We believe in recognizing the valuable work of security researchers:

We maintain a Security Researchers Hall of Fame acknowledging contributors who have responsibly disclosed vulnerabilities.

• Public Recognition: listed in our Hall of Fame (if you wish)
• CVE Credit: named in the CVE and security advisory
• Direct Communication: with our security team
• Early Notification: of the fix before public disclosure

• We do not currently offer a bug bounty program
• We do not provide financial rewards
• We cannot guarantee job opportunities

Hyland supports security research and wants security researchers to feel comfortable reporting vulnerabilities. We will not pursue civil or criminal action, or send notice to law enforcement for accidental or good faith violations of this policy. We consider security research conducted consistent with this policy to be:

• Authorized concerning any application of anti-hacking laws
• Exempt from restrictions in our Terms of Service that would interfere with research
• Lawful, helpful to security, and conducted in good faith

You must:

• Comply with this policy
• Act in good faith
• Not intentionally harm users or Hyland
• Not access, modify, or exfiltrate data beyond what is necessary to demonstrate the vulnerability

By participating in our vulnerability disclosure program, you agree that:

• You will not exploit the vulnerability beyond the minimum necessary to prove it exists
• You will report vulnerabilities privately and will not disclose them publicly until we have had adequate time to address them
• You will comply with all applicable laws
• All information you provide will be used only for security purposes

• OWASP Top Ten
• Common Vulnerabilities and Exposures (CVE)
• Common Vulnerability Scoring System (CVSS)
• HackerOne Disclosure Guidelines

Thank you for helping keep Hyland OpenArch and our users safe!