Security

Reporting a vulnerability

Email support@bambooforge.dev with SECURITY in the subject line.

Tell us which app and version, what an attacker can do, and enough detail to reproduce it. Please do not publish it while we are fixing it, and please do not include a working exploit in the first email - describe the class of problem and we will come back to you.

We will acknowledge within two business days, tell you our assessment within five, and ship a fix for anything we agree is exploitable. We will credit you by name in the release note unless you would rather we did not.

We do not run a paid bug bounty.

How the apps are built

• Every model has explicit access rules, and record rules where the data is per-company or per-user. We test them: the test suites assert that a user outside the group is refused, not merely that the intended user is allowed.

• Multi-company apps filter by company in the record rule, not only in the view.

• SQL is parameterised. Where an app builds a query, the values are bound, never interpolated.

• Nothing in an app evaluates data supplied by an untrusted user as code.

• Credentials you configure - API keys, passwords for the systems a connector talks to - are stored in Odoo's own configuration models and are readable only by the administrator group.

The demo servers

demo16 to demo19.bambooforge.dev are deliberately exposed sandboxes. The database manager is disabled, the demo user is not an administrator, and the whole database is destroyed and rebuilt every night. They hold no real data and are not connected to anything of ours that does.