← Back

Reporting a security problem

Last updated 21 October 2026

If you think you have found a security problem in 1ClickOps, please tell us at support@1clickops.comwith "Security" in the subject. Include what you found, how to reproduce it, and what it could let someone do.

What we promise

  • We reply within three working days to say we have it.
  • We keep you told what we are doing about it, and when it is fixed.
  • We will not take legal action against research done in good faith under this page.
  • With your permission, we name you when we describe the fix.

In scope

  • The dashboard and API at www.1clickops.com.
  • The 1ClickOps agent, both the native program and the script, and the way it is installed and updated.
  • Anything that lets an instruction run on a server that its owner did not ask for, or lets one workspace see or change another's.

Please do not

  • Use a server, app or account that is not yours. Connect a server of your own to test against.
  • Read, change or keep anyone else's data. If you reach some by accident, stop, and tell us.
  • Run denial-of-service tests, send spam through our sign-in emails, or try to trick our staff.
  • Publish details before we have fixed the problem, or 90 days have passed since you told us.

Questions about this page? Email support@1clickops.com.