PageSourceSearch

https://odit.et/security

html odit.et collected 2026-09-24 14:21:27 UTC 32,566 bytes, 16 lines download raw bytes

1<!DOCTYPE html><!--qc_TD69OPcKlTTlt9g2Ho--><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="stylesheet" href="/_next/static/css/c9c844784829898a.css?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" data-precedence="next"/><link rel="stylesheet" href="/_next/static/css/92f193a281c7fc51.css?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" data-precedence="next"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack-fdf73a5476d0aa64.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ"/>
1<script src="/_next/static/chunks/cbfddaed-77f61b9557a9f56b.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/98a8d629-956a66c5a01af0ac.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/3594-cb1f810c53aeba9d.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/main-app-80be3d8f848637f9.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/2230-0fb11862e8637a27.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/app/layout-44f78b72e8ed5812.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/7121-cf2791c950bd4b63.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<script src="/_next/static/chunks/app/(legal)/security/page-fa015a9ad51363a3.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" async=""></script>
1<link rel="preload" href="https://stats.robi.work/script.js" as="script"/><link rel="preload" href="https://www.googletagmanager.com/gtag/js?id=G-5D37B65HR5" as="script"/><title>Security &amp; Responsible Disclosure | Odit</title><meta name="description" content="How to report a security vulnerability in Odit (odit.et and the com.robi.odit Android app), what is in scope, and the safe-harbour terms for good-faith research."/><meta name="application-name" content="Odit"/><link rel="manifest" href="/site.webmanifest"/><meta name="robots" content="index, follow"/><meta name="category" content="finance"/><link rel="canonical" href="https://odit.et/security"/><meta property="og:title" content="Odit: track your money from the bank SMS you already get"/><meta property="og:description" content="Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more."/><meta property="og:url" content="https://odit.et"/><meta property="og:site_name" content="Odit"/><meta property="og:locale" content="en_ET"/><meta property="og:image:alt" content="Odit: personal finance from the SMS your bank already sends you"/><meta property="og:image:type" content="image/png"/><meta property="og:image" content="https://odit.et/opengraph-image?6adbbb118b4a66e6"/><meta property="og:image:width" content="1200"/><meta property="og:image:height" content="630"/><meta property="og:type" content="website"/><meta name="twitter:card" content="summary_large_image"/><meta name="twitter:site" content="@odit"/><meta name="twitter:creator" content="@odit"/><meta name="twitter:title" content="Odit: track your money from the bank SMS you already get"/><meta name="twitter:description" content="Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more."/><meta name="twitter:image:alt" content="Odit: personal finance from the SMS your bank already sends you"/><meta name="twitter:image:type" content="image/png"/><meta name="twitter:image" content="https://odit.et/opengraph-image?6adbbb118b4a66e6"/><meta name="twitter:image:width" content="1200"/><meta name="twitter:image:height" content="630"/><link rel="icon" href="/favicon.svg" type="image/svg+xml"/><link rel="icon" href="/favicon-32x32.png" sizes="32x32" type="image/png"/><link rel="icon" href="/favicon-16x16.png" sizes="16x16" type="image/png"/><link rel="icon" href="/favicon.ico" sizes="16x16 32x32 48x48" type="image/x-icon"/><link rel="apple-touch-icon" href="/apple-touch-icon.png" sizes="180x180"/>
1<script>
2try {
3  const stored = localStorage.getItem('preferences');
4  if (stored) {
5    const preferences = JSON.parse(stored);
6    document.documentElement.classList.toggle('dark', preferences.theme === 'dark');
7    document.documentElement.classList.toggle('light', preferences.theme !== 'dark');
8  } else {
9    document.documentElement.classList.add('light');
10    document.documentElement.classList.remove('dark');
11  }
12} catch (e) {
13  document.documentElement.classList.add('light');
14  document.documentElement.classList.remove('dark');
15}
16</script>
16<script src="/_next/static/chunks/polyfills-42372ed130431b0a.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" noModule=""></script>
16</head><body><div hidden=""><!--$--><!--/$--></div>
16<script type="application/ld+json">{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://odit.et/#organization","name":"Odit","url":"https://odit.et","description":"Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more.","logo":"https://odit.et/android-chrome-512x512.png","email":"[email protected]","areaServed":{"@type":"Country","name":"Ethiopia"}},{"@type":"WebSite","@id":"https://odit.et/#website","name":"Odit","url":"https://odit.et","description":"Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more.","inLanguage":"en","publisher":{"@id":"https://odit.et/#organization"}},{"@type":"MobileApplication","@id":"https://odit.et/#app","name":"Odit","description":"Take control of your finances, one SMS at a time.","applicationCategory":"FinanceApplication","operatingSystem":"Android","url":"https://play.google.com/store/apps/details?id=com.robi.odit","installUrl":"https://play.google.com/store/apps/details?id=com.robi.odit","identifier":"com.robi.odit","publisher":{"@id":"https://odit.et/#organization"},"offers":{"@type":"Offer","price":"0","priceCurrency":"ETB"}}]}</script>
16<svg class="absolute"><filter id="grain"><feTurbulence type="turbulence" baseFrequency="0.69"></feTurbulence></filter></svg><section aria-label="Notifications alt+T" tabindex="-1" aria-live="polite" aria-relevant="additions text" aria-atomic="false"></section><div style="display:contents;min-height:100vh"><div class="legal text-muted-foreground mx-auto max-w-3xl px-6 py-16"><div class="mb-10"><a class="ring-offset-background focus-visible:ring-ring inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-xl text-sm transition-colors focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 [&amp;_svg]:pointer-events-none [&amp;_svg]:size-4 [&amp;_svg]:shrink-0 h-10 px-4 py-2 text-muted-foreground hover:bg-accent hover:text-foreground -ml-3 mb-6" href="/auth/login">← Back</a><h1 class="text-foreground mb-2 text-2xl font-normal tracking-tight">Security &amp; Responsible Disclosure</h1><p class="text-muted-foreground text-sm">Last updated September 7, 2026</p></div><div class="space-y-10 text-[0.95rem] leading-relaxed"><section><h2 id="reporting">1. Reporting a vulnerability<!-- --> <a href="#reporting" class="anchor" aria-label="Link to Reporting a vulnerability">#</a></h2><p>Email<!-- --> <a href="mailto:[email protected]?subject=Security%20report" class="text-foreground hover:text-muted-foreground underline underline-offset-2">[email protected]</a> <!-- -->with “Security” in the subject. Please include enough detail to reproduce the issue: the endpoint or screen, the request, what you expected, and what happened instead. A short proof of concept is worth more than a scanner report.</p><p>We will acknowledge your report within <strong>3 working days</strong> and tell you whether we can reproduce it. We will keep you updated while we work on a fix, and we are happy to credit you publicly once it ships, if you would like that. We do not currently run a paid bug bounty.</p><p>Odit is a small team handling people’s financial data. We take reports seriously and would much rather hear from you than find out from our logs.</p></section><section><h2 id="scope">2. Scope<!-- --> <a href="#scope" class="anchor" aria-label="Link to Scope">#</a></h2><p>In scope:</p><ul><li><code>odit.et</code>, the web dashboard;</li><li><code>sp.odit.et</code>, the API the app and dashboard talk to;</li><li>the <code>com.robi.odit</code> Android app.</li></ul><p>Out of scope, and we would rather you did not spend time on them:</p><ul><li>Findings that only a scanner considers issues: missing headers, cookie flags, or version banners with no demonstrated impact;</li><li>Denial of service, traffic floods, and anything that degrades the service for real users;</li><li>Social engineering of our users or staff, and physical attacks;</li><li>Reports about third-party services we depend on. Send those to the third party;</li><li>Anything requiring a rooted device plus physical access to that same device.</li></ul></section><section><h2 id="rules">3. Testing safely<!-- --> <a href="#rules" class="anchor" aria-label="Link to Testing safely">#</a></h2><p>This is a live service holding real people’s bank messages. Two rules matter more than the rest:</p><ul><li><strong>Use your own account and your own data.</strong> If you find a way to read another user’s records, stop at the point where you have proved it works. Do not enumerate, collect, or retain anyone else’s data, and tell us instead.</li><li><strong>Ask us before doing anything at volume.</strong> If your testing needs several accounts, load, or automated scanning, email us first and we will set you up with test accounts and a window. Bulk sign-ups and floods are indistinguishable from an attack from where we sit, and we will treat them as one.</li></ul><p>Otherwise: do not modify or delete data that is not yours, do not persist access, and give us a reasonable chance to fix an issue before you publish it. Ninety days is a sensible default, and we will usually be much faster.</p></section><section><h2 id="safe-harbour">4. Safe harbour<!-- --> <a href="#safe-harbour" class="anchor" aria-label="Link to Safe harbour">#</a></h2><p>If you follow this policy in good faith, we will treat your research as authorised. We will not pursue legal action against you or ask anyone else to, and we will say so if a third party comes asking. If you are unsure whether something is allowed, ask first. A question costs us nothing and protects you.</p><p>This does not extend to accessing, downloading, or retaining other people’s data beyond the minimum needed to demonstrate a finding, and it does not override our obligations under Ethiopian law.</p></section><section><h2 id="machine-readable">
165. security.txt<!-- --> <a href="#machine-readable" class="anchor" aria-label="Link to security.txt">#</a></h2><p>The machine-readable version of this contact information lives at<!-- --> <a href="/.well-known/security.txt" class="text-foreground hover:text-muted-foreground underline underline-offset-2">/.well-known/security.txt</a>, per RFC 9116.</p></section></div></div><!--$--><!--/$--></div>
16<script src="/_next/static/chunks/webpack-fdf73a5476d0aa64.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ" id="_R_" async=""></script>
16<script>(self.__next_f=self.__next_f||[]).push([0])</script>
16<script>self.__next_f.push([1,"1:\"$Sreact.fragment\"\n3:I[84517,[\"2230\",\"static/chunks/2230-0fb11862e8637a27.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"7177\",\"static/chunks/app/layout-44f78b72e8ed5812.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\"],\"Toaster\"]\n4:I[33819,[\"2230\",\"static/chunks/2230-0fb11862e8637a27.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"7177\",\"static/chunks/app/layout-44f78b72e8ed5812.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\"],\"PreferencesProvider\"]\n5:I[50177,[\"2230\",\"static/chunks/2230-0fb11862e8637a27.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"7177\",\"static/chunks/app/layout-44f78b72e8ed5812.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\"],\"NavigationProgressProvider\"]\n6:I[29536,[],\"\"]\n7:I[99686,[],\"\"]\n10:I[62460,[],\"\"]\n:HL[\"/_next/static/css/c9c844784829898a.css?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"style\"]\n:HL[\"/_next/static/css/92f193a281c7fc51.css?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"style\"]\n2:T4f4,"])</script>
16<script>self.__next_f.push([1,"{\"@context\":\"https://schema.org\",\"@graph\":[{\"@type\":\"Organization\",\"@id\":\"https://odit.et/#organization\",\"name\":\"Odit\",\"url\":\"https://odit.et\",\"description\":\"Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more.\",\"logo\":\"https://odit.et/android-chrome-512x512.png\",\"email\":\"[email protected]\",\"areaServed\":{\"@type\":\"Country\",\"name\":\"Ethiopia\"}},{\"@type\":\"WebSite\",\"@id\":\"https://odit.et/#website\",\"name\":\"Odit\",\"url\":\"https://odit.et\",\"description\":\"Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more.\",\"inLanguage\":\"en\",\"publisher\":{\"@id\":\"https://odit.et/#organization\"}},{\"@type\":\"MobileApplication\",\"@id\":\"https://odit.et/#app\",\"name\":\"Odit\",\"description\":\"Take control of your finances, one SMS at a time.\",\"applicationCategory\":\"FinanceApplication\",\"operatingSystem\":\"Android\",\"url\":\"https://play.google.com/store/apps/details?id=com.robi.odit\",\"installUrl\":\"https://play.google.com/store/apps/details?id=com.robi.odit\",\"identifier\":\"com.robi.odit\",\"publisher\":{\"@id\":\"https://odit.et/#organization\"},\"offers\":{\"@type\":\"Offer\",\"price\":\"0\",\"priceCurrency\":\"ETB\"}}]}"])</script>
16<script>self.__next_f.push([1,"0:{\"P\":null,\"b\":\"qc-TD69OPcKlTTlt9g2Ho\",\"p\":\"\",\"c\":[\"\",\"security\"],\"i\":false,\"f\":[[[\"\",{\"children\":[\"(legal)\",{\"children\":[\"security\",{\"children\":[\"__PAGE__\",{}]}]}]},\"$undefined\",\"$undefined\",true],[\"\",[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/c9c844784829898a.css?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],[\"$\",\"html\",null,{\"lang\":\"en\",\"suppressHydrationWarning\":true,\"children\":[[\"$\",\"head\",null,{\"children\":[[\"$\",\"meta\",null,{\"name\":\"viewport\",\"content\":\"width=device-width\"}],[\"$\",\"script\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"\\ntry {\\n  const stored = localStorage.getItem('preferences');\\n  if (stored) {\\n    const preferences = JSON.parse(stored);\\n    document.documentElement.classList.toggle('dark', preferences.theme === 'dark');\\n    document.documentElement.classList.toggle('light', preferences.theme !== 'dark');\\n  } else {\\n    document.documentElement.classList.add('light');\\n    document.documentElement.classList.remove('dark');\\n  }\\n} catch (e) {\\n  document.documentElement.classList.add('light');\\n  document.documentElement.classList.remove('dark');\\n}\\n\"}}]]}],[\"$\",\"body\",null,{\"children\":[[\"$\",\"script\",null,{\"type\":\"application/ld+json\",\"dangerouslySetInnerHTML\":{\"__html\":\"$2\"}}],[\"$\",\"svg\",null,{\"className\":\"absolute\",\"children\":[\"$\",\"filter\",null,{\"id\":\"grain\",\"children\":[\"$\",\"feTurbulence\",null,{\"type\":\"turbulence\",\"baseFrequency\":\"0.69\"}]}]}],[\"$\",\"$L3\",null,{}],[\"$\",\"$L4\",null,{\"children\":[\"$\",\"$L5\",null,{\"children\":[\"$\",\"div\",null,{\"style\":{\"display\":\"contents\",\"minHeight\":\"100vh\"},\"children\":[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":{\"fontFamily\":\"system-ui,\\\"Segoe UI\\\",Roboto,Helvetica,Arial,sans-serif,\\\"Apple Color Emoji\\\",\\\"Segoe UI Emoji\\\"\",\"height\":\"100vh\",\"textAlign\":\"center\",\"display\":\"flex\",\"flexDirection\":\"column\",\"alignItems\":\"center\",\"justifyContent\":\"center\"},\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":{\"display\":\"inline-block\",\"margin\":\"0 20px 0 0\",\"padding\":\"0 23px 0 0\",\"fontSize\":24,\"fontWeight\":500,\"verticalAlign\":\"top\",\"lineHeight\":\"49px\"},\"children\":404}],\"$L8\"]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]}]}]}],\"$L9\",\"$La\",\"$Lb\"]}]]}]]}],{\"children\":[\"(legal)\",\"$Lc\",{\"children\":[\"security\",\"$Ld\",{\"children\":[\"__PAGE__\",\"$Le\",{},null,false]},null,false]},null,false]},null,false],\"$Lf\",false]],\"m\":\"$undefined\",\"G\":[\"$10\",[]],\"s\":false,\"S\":true}\n"])</script>
16<script>self.__next_f.push([1,"11:I[49292,[\"2230\",\"static/chunks/2230-0fb11862e8637a27.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"7177\",\"static/chunks/app/layout-44f78b72e8ed5812.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\"],\"\"]\n12:I[7121,[\"7121\",\"static/chunks/7121-cf2791c950bd4b63.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"6932\",\"static/chunks/app/(legal)/security/page-fa015a9ad51363a3.js?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\"],\"\"]\n18:I[80173,[],\"ViewportBoundary\"]\n1a:I[80173,[],\"MetadataBoundary\"]\n1b:\"$Sreact.suspense\"\n8:[\"$\",\"div\",null,{\"style\":{\"display\":\"inline-block\"},\"children\":[\"$\",\"h2\",null,{\"style\":{\"fontSize\":14,\"fontWeight\":400,\"lineHeight\":\"49px\",\"margin\":0},\"children\":\"This page could not be found.\"}]}]\n9:[\"$\",\"$L11\",null,{\"src\":\"https://stats.robi.work/script.js\",\"data-website-id\":\"70b91426-4375-453b-9c6b-15ead2ba2cd4\",\"data-exclude-search\":\"true\",\"strategy\":\"afterInteractive\"}]\na:[\"$\",\"$L11\",null,{\"src\":\"https://www.googletagmanager.com/gtag/js?id=G-5D37B65HR5\",\"strategy\":\"afterInteractive\"}]\nb:[\"$\",\"$L11\",null,{\"id\":\"gtag-init\",\"strategy\":\"afterInteractive\",\"children\":\"window.dataLayer = window.dataLayer || [];\\nfunction gtag(){dataLayer.push(arguments);}\\ngtag('js', new Date());\\ngtag('config', 'G-5D37B65HR5', { page_location: location.origin + location.pathname });\"}]\n"])</script>
16<script>self.__next_f.push([1,"c:[\"$\",\"$1\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/92f193a281c7fc51.css?dpl=dpl_6vds81sVg554M3cq7QxQJmPEi8wJ\",\"precedence\":\"next\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"}]],[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[[[\"$\",\"title\",null,{\"children\":\"404: This page could not be found.\"}],[\"$\",\"div\",null,{\"style\":\"$0:f:0:1:1:props:children:1:props:children:1:props:children:3:props:children:props:children:props:children:props:notFound:0:1:props:style\",\"children\":[\"$\",\"div\",null,{\"children\":[[\"$\",\"style\",null,{\"dangerouslySetInnerHTML\":{\"__html\":\"body{color:#000;background:#fff;margin:0}.next-error-h1{border-right:1px solid rgba(0,0,0,.3)}@media (prefers-color-scheme:dark){body{color:#fff;background:#000}.next-error-h1{border-right:1px solid rgba(255,255,255,.3)}}\"}}],[\"$\",\"h1\",null,{\"className\":\"next-error-h1\",\"style\":\"$0:f:0:1:1:props:children:1:props:children:1:props:children:3:props:children:props:children:props:children:props:notFound:0:1:props:children:props:children:1:props:style\",\"children\":404}],[\"$\",\"div\",null,{\"style\":\"$8:props:style\",\"children\":[\"$\",\"h2\",null,{\"style\":\"$8:props:children:props:style\",\"children\":\"This page could not be found.\"}]}]]}]}]],[]],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n"])</script>
16<script>self.__next_f.push([1,"d:[\"$\",\"$1\",\"c\",{\"children\":[null,[\"$\",\"$L6\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$L7\",null,{}],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\"}]]}]\n"])</script>
16<script>self.__next_f.push([1,"e:[\"$\",\"$1\",\"c\",{\"children\":[[\"$\",\"div\",null,{\"className\":\"legal text-muted-foreground mx-auto max-w-3xl px-6 py-16\",\"children\":[[\"$\",\"div\",null,{\"className\":\"mb-10\",\"children\":[[\"$\",\"$L12\",null,{\"href\":\"/auth/login\",\"children\":\"← Back\",\"className\":\"ring-offset-background focus-visible:ring-ring inline-flex items-center justify-center gap-2 whitespace-nowrap rounded-xl text-sm transition-colors focus-visible:outline-hidden focus-visible:ring-2 focus-visible:ring-offset-2 disabled:pointer-events-none disabled:opacity-50 [\u0026_svg]:pointer-events-none [\u0026_svg]:size-4 [\u0026_svg]:shrink-0 h-10 px-4 py-2 text-muted-foreground hover:bg-accent hover:text-foreground -ml-3 mb-6\",\"ref\":null}],[\"$\",\"h1\",null,{\"className\":\"text-foreground mb-2 text-2xl font-normal tracking-tight\",\"children\":\"Security \u0026 Responsible Disclosure\"}],[\"$\",\"p\",null,{\"className\":\"text-muted-foreground text-sm\",\"children\":\"Last updated September 7, 2026\"}]]}],[\"$\",\"div\",null,{\"className\":\"space-y-10 text-[0.95rem] leading-relaxed\",\"children\":[[\"$\",\"section\",null,{\"children\":[[\"$\",\"h2\",null,{\"id\":\"reporting\",\"children\":[\"1. Reporting a vulnerability\",\" \",[\"$\",\"a\",null,{\"href\":\"#reporting\",\"className\":\"anchor\",\"aria-label\":\"Link to Reporting a vulnerability\",\"children\":\"#\"}]]}],[\"$\",\"p\",null,{\"children\":[\"Email\",\" \",[\"$\",\"a\",null,{\"href\":\"mailto:[email protected]?subject=Security%20report\",\"className\":\"text-foreground hover:text-muted-foreground underline underline-offset-2\",\"children\":\"[email protected]\"}],\" \",\"with “Security” in the subject. Please include enough detail to reproduce the issue: the endpoint or screen, the request, what you expected, and what happened instead. A short proof of concept is worth more than a scanner report.\"]}],[\"$\",\"p\",null,{\"children\":[\"We will acknowledge your report within \",[\"$\",\"strong\",null,{\"children\":\"3 working days\"}],\" and tell you whether we can reproduce it. We will keep you updated while we work on a fix, and we are happy to credit you publicly once it ships, if you would like that. We do not currently run a paid bug bounty.\"]}],[\"$\",\"p\",null,{\"children\":\"Odit is a small team handling people’s financial data. We take reports seriously and would much rather hear from you than find out from our logs.\"}]]}],[\"$\",\"section\",null,{\"children\":[[\"$\",\"h2\",null,{\"id\":\"scope\",\"children\":[\"2. Scope\",\" \",[\"$\",\"a\",null,{\"href\":\"#scope\",\"className\":\"anchor\",\"aria-label\":\"Link to Scope\",\"children\":\"#\"}]]}],[\"$\",\"p\",null,{\"children\":\"In scope:\"}],[\"$\",\"ul\",null,{\"children\":[[\"$\",\"li\",null,{\"children\":[[\"$\",\"code\",null,{\"children\":\"odit.et\"}],\", the web dashboard;\"]}],[\"$\",\"li\",null,{\"children\":[[\"$\",\"code\",null,{\"children\":\"sp.odit.et\"}],\", the API the app and dashboard talk to;\"]}],[\"$\",\"li\",null,{\"children\":[\"the \",[\"$\",\"code\",null,{\"children\":\"com.robi.odit\"}],\" Android app.\"]}]]}],[\"$\",\"p\",null,{\"children\":\"Out of scope, and we would rather you did not spend time on them:\"}],[\"$\",\"ul\",null,{\"children\":[[\"$\",\"li\",null,{\"children\":\"Findings that only a scanner considers issues: missing headers, cookie flags, or version banners with no demonstrated impact;\"}],[\"$\",\"li\",null,{\"children\":\"Denial of service, traffic floods, and anything that degrades the service for real users;\"}],[\"$\",\"li\",null,{\"children\":\"Social engineering of our users or staff, and physical attacks;\"}],[\"$\",\"li\",null,{\"children\":\"Reports about third-party services we depend on. Send those to the third party;\"}],[\"$\",\"li\",null,{\"children\":\"Anything requiring a rooted device plus physical access to that same device.\"}]]}]]}],[\"$\",\"section\",null,{\"children\":[[\"$\",\"h2\",null,{\"id\":\"rules\",\"children\":[\"3. Testing safely\",\" \",[\"$\",\"a\",null,{\"href\":\"#rules\",\"className\":\"anchor\",\"aria-label\":\"Link to Testing safely\",\"children\":\"#\"}]]}],[\"$\",\"p\",null,{\"children\":\"This is a live service holding real people’s bank messages. Two rules matter more than the rest:\"}],[\"$\",\"ul\",null,{\"children\":[[\"$\",\"li\",null,{\"children\":[[\"$\",\"strong\",null,{\"children\":\"Use your own account and 
16your own data.\"}],\" If you find a way to read another user’s records, stop at the point where you have proved it works. Do not enumerate, collect, or retain anyone else’s data, and tell us instead.\"]}],\"$L13\"]}],\"$L14\"]}],\"$L15\",\"$L16\"]}]]}],null,\"$L17\"]}]\n"])</script>
16<script>self.__next_f.push([1,"f:[\"$\",\"$1\",\"h\",{\"children\":[null,[[\"$\",\"$L18\",null,{\"children\":\"$L19\"}],null],[\"$\",\"$L1a\",null,{\"children\":[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$1b\",null,{\"fallback\":null,\"children\":\"$L1c\"}]}]}]]}]\n"])</script>
16<script>self.__next_f.push([1,"1d:I[80173,[],\"OutletBoundary\"]\n1f:I[16824,[],\"AsyncMetadataOutlet\"]\n13:[\"$\",\"li\",null,{\"children\":[[\"$\",\"strong\",null,{\"children\":\"Ask us before doing anything at volume.\"}],\" If your testing needs several accounts, load, or automated scanning, email us first and we will set you up with test accounts and a window. Bulk sign-ups and floods are indistinguishable from an attack from where we sit, and we will treat them as one.\"]}]\n14:[\"$\",\"p\",null,{\"children\":\"Otherwise: do not modify or delete data that is not yours, do not persist access, and give us a reasonable chance to fix an issue before you publish it. Ninety days is a sensible default, and we will usually be much faster.\"}]\n"])</script>
16<script>self.__next_f.push([1,"15:[\"$\",\"section\",null,{\"children\":[[\"$\",\"h2\",null,{\"id\":\"safe-harbour\",\"children\":[\"4. Safe harbour\",\" \",[\"$\",\"a\",null,{\"href\":\"#safe-harbour\",\"className\":\"anchor\",\"aria-label\":\"Link to Safe harbour\",\"children\":\"#\"}]]}],[\"$\",\"p\",null,{\"children\":\"If you follow this policy in good faith, we will treat your research as authorised. We will not pursue legal action against you or ask anyone else to, and we will say so if a third party comes asking. If you are unsure whether something is allowed, ask first. A question costs us nothing and protects you.\"}],[\"$\",\"p\",null,{\"children\":\"This does not extend to accessing, downloading, or retaining other people’s data beyond the minimum needed to demonstrate a finding, and it does not override our obligations under Ethiopian law.\"}]]}]\n"])</script>
16<script>self.__next_f.push([1,"16:[\"$\",\"section\",null,{\"children\":[[\"$\",\"h2\",null,{\"id\":\"machine-readable\",\"children\":[\"5. security.txt\",\" \",[\"$\",\"a\",null,{\"href\":\"#machine-readable\",\"className\":\"anchor\",\"aria-label\":\"Link to security.txt\",\"children\":\"#\"}]]}],[\"$\",\"p\",null,{\"children\":[\"The machine-readable version of this contact information lives at\",\" \",[\"$\",\"a\",null,{\"href\":\"/.well-known/security.txt\",\"className\":\"text-foreground hover:text-muted-foreground underline underline-offset-2\",\"children\":\"/.well-known/security.txt\"}],\", per RFC 9116.\"]}]]}]\n17:[\"$\",\"$L1d\",null,{\"children\":[\"$L1e\",[\"$\",\"$L1f\",null,{\"promise\":\"$@20\"}]]}]\n"])</script>
16<script>self.__next_f.push([1,"19:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"}],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"}]]\n"])</script>
16<script>self.__next_f.push([1,"1e:null\n"])</script>
16<script>self.__next_f.push([1,"21:I[56376,[],\"IconMark\"]\n"])</script>
16<script>self.__next_f.push([1,"20:{\"metadata\":[[\"$\",\"title\",\"0\",{\"children\":\"Security \u0026 Responsible Disclosure | Odit\"}],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"How to report a security vulnerability in Odit (odit.et and the com.robi.odit Android app), what is in scope, and the safe-harbour terms for good-faith research.\"}],[\"$\",\"meta\",\"2\",{\"name\":\"application-name\",\"content\":\"Odit\"}],[\"$\",\"link\",\"3\",{\"rel\":\"manifest\",\"href\":\"/site.webmanifest\",\"crossOrigin\":\"$undefined\"}],[\"$\",\"meta\",\"4\",{\"name\":\"robots\",\"content\":\"index, follow\"}],[\"$\",\"meta\",\"5\",{\"name\":\"category\",\"content\":\"finance\"}],[\"$\",\"link\",\"6\",{\"rel\":\"canonical\",\"href\":\"https://odit.et/security\"}],[\"$\",\"meta\",\"7\",{\"property\":\"og:title\",\"content\":\"Odit: track your money from the bank SMS you already get\"}],[\"$\",\"meta\",\"8\",{\"property\":\"og:description\",\"content\":\"Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more.\"}],[\"$\",\"meta\",\"9\",{\"property\":\"og:url\",\"content\":\"https://odit.et\"}],[\"$\",\"meta\",\"10\",{\"property\":\"og:site_name\",\"content\":\"Odit\"}],[\"$\",\"meta\",\"11\",{\"property\":\"og:locale\",\"content\":\"en_ET\"}],[\"$\",\"meta\",\"12\",{\"property\":\"og:image:alt\",\"content\":\"Odit: personal finance from the SMS your bank already sends you\"}],[\"$\",\"meta\",\"13\",{\"property\":\"og:image:type\",\"content\":\"image/png\"}],[\"$\",\"meta\",\"14\",{\"property\":\"og:image\",\"content\":\"https://odit.et/opengraph-image?6adbbb118b4a66e6\"}],[\"$\",\"meta\",\"15\",{\"property\":\"og:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"16\",{\"property\":\"og:image:height\",\"content\":\"630\"}],[\"$\",\"meta\",\"17\",{\"property\":\"og:type\",\"content\":\"website\"}],[\"$\",\"meta\",\"18\",{\"name\":\"twitter:card\",\"content\":\"summary_large_image\"}],[\"$\",\"meta\",\"19\",{\"name\":\"twitter:site\",\"content\":\"@odit\"}],[\"$\",\"meta\",\"20\",{\"name\":\"twitter:creator\",\"content\":\"@odit\"}],[\"$\",\"meta\",\"21\",{\"name\":\"twitter:title\",\"content\":\"Odit: track your money from the bank SMS you already get\"}],[\"$\",\"meta\",\"22\",{\"name\":\"twitter:description\",\"content\":\"Odit turns the transaction SMS your Ethiopian bank already sends into a running record of your money, across CBE, telebirr, Awash, Dashen, BOA and more.\"}],[\"$\",\"meta\",\"23\",{\"name\":\"twitter:image:alt\",\"content\":\"Odit: personal finance from the SMS your bank already sends you\"}],[\"$\",\"meta\",\"24\",{\"name\":\"twitter:image:type\",\"content\":\"image/png\"}],[\"$\",\"meta\",\"25\",{\"name\":\"twitter:image\",\"content\":\"https://odit.et/opengraph-image?6adbbb118b4a66e6\"}],[\"$\",\"meta\",\"26\",{\"name\":\"twitter:image:width\",\"content\":\"1200\"}],[\"$\",\"meta\",\"27\",{\"name\":\"twitter:image:height\",\"content\":\"630\"}],[\"$\",\"link\",\"28\",{\"rel\":\"icon\",\"href\":\"/favicon.svg\",\"type\":\"image/svg+xml\"}],[\"$\",\"link\",\"29\",{\"rel\":\"icon\",\"href\":\"/favicon-32x32.png\",\"sizes\":\"32x32\",\"type\":\"image/png\"}],[\"$\",\"link\",\"30\",{\"rel\":\"icon\",\"href\":\"/favicon-16x16.png\",\"sizes\":\"16x16\",\"type\":\"image/png\"}],[\"$\",\"link\",\"31\",{\"rel\":\"icon\",\"href\":\"/favicon.ico\",\"sizes\":\"16x16 32x32 48x48\",\"type\":\"image/x-icon\"}],[\"$\",\"link\",\"32\",{\"rel\":\"apple-touch-icon\",\"href\":\"/apple-touch-icon.png\",\"sizes\":\"180x180\"}],[\"$\",\"$L21\",\"33\",{}]],\"error\":null,\"digest\":\"$undefined\"}\n"])</script>
16<script>self.__next_f.push([1,"1c:\"$20:metadata\"\n"])</script>
16</body></html>

Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.