The safety of Odoo systems is very important to us (not only because we use Odoo internally), and we consider security problems with the highest priority. We do our best every day to protect Odoo users from known security threats, and we welcome all reports of security vulnerabilities discovered by our users and contributors.

We are committed to handle vulnerability reports with the greatest attention, provided that the following rules are respected.

Reporting an issue

Rules

We ask you to observe the following rules at all times:

• Exclusively test vulnerabilities on your own deployments, on demo.odoo.com, or on your own trial instances of Odoo Online
• Never attempt to access or modify data that does not belong to you
• Never attempt to execute denial of service attacks, or to compromise the reliability and integrity of services that do not belong to you
• Do not use scanners or automated tools to find vulnerabilities, as their effects will violate the previous rules
• Never attempt non-technical attacks such as social engineering, phishing, or physical attacks against anyone or any system
• Do not publicly disclose vulnerabilities without our prior consent (see also the Disclosure Procedure above). During the non-disclosure period you are authorized to use/test any correction we've provided, as long as no emphasis is put on that correction and it is not published in the form of a security report (i.e. using it on production servers is fine).

In return:

• We will not initiate legal action against you if you followed the rules
• We will process your report and respond as quickly as possible
• We will provide a fix as soon as possible
• We will keep you updated of the progress and disclosure steps (see also the Disclosure Procedure above)
• We will work diligently with stakeholders and customers in order to help them restore the safety of their system
• We will not publically disclose your identity if you do not want to be credited for your discovery