Security Policy

1. What is covered

This policy covers the current public ordo Android app, the current ordo server source, ordo Cloud at api.ordo.axolet.com, and this website. A vulnerability in ordo’s code is covered even when you found it on a server you run.

A third-party website opened through ordo, GitHub, Expo, Resend, Cloudflare, a phone’s operating system, and a server that is insecure only because of how it was deployed are outside this policy. A dangerous default, or a bug that causes that insecure deployment, is covered.

2. What to send

A report Axolet can act on includes:

• the component, version, URL, and whether it is ordo Cloud or a server you run;
• what someone can do with the issue, and who is affected;
• steps to reproduce it, or a minimal demonstration;
• logs or requests with secrets and personal data removed; and
• a way to reply to you.

3. How to test

Act in good faith. Test only accounts, data, and systems you own or have permission to test. Stop once the issue is confirmed. Do not read, keep, change, or publish someone else’s data. Do not reduce the availability of the service, send unsolicited messages, use social engineering, or deploy malware. Do not ask for payment as a condition of the report.

Use the smallest activity that shows the impact. If you come across personal data or a secret, stop, do not copy it, and describe the exposure in the private report.

Axolet does not run a paid bug-bounty program and does not promise a reward.

4. What Axolet will do

Axolet will read a good-faith report, investigate an issue it can reproduce, and fix issues in order of severity and how many people they affect. Some fixes take longer because they need a new Android build or a coordinated release. Axolet may ask for more information.

Give Axolet a reasonable chance to investigate and ship a fix before you publish the details. Axolet will write back when there is something useful to say. There is no fixed response time.

5. Safe harbor

If you make a good-faith effort to follow this policy, Axolet will not bring a legal claim against you for an accidental, limited departure from these rules that was part of that research. This safe harbor does not allow a violation of the law or of someone else’s rights, and it binds Axolet Private Limited only.

6. Controls in the software

Account passwords are hashed with bcrypt at cost 12. New session tokens are stored as HMAC-SHA256 keyed with the server secret. A session created before that change can still be checked against an unsalted SHA-256 of the token.

An access token lasts 15 minutes. A refresh token lasts 30 days and is rotated on use. Presenting a refresh token that has already been rotated revokes that session. A session is refused after 14 days without use. An account is limited to ten sessions. Cookie sessions use a double-submit CSRF token, compared in constant time. The Android app uses a bearer token, so that cookie check does not apply to it.

Email codes are six digits, expire after ten minutes, and allow five attempts. They are stored as a hash that includes the server secret and the account. TOTP secrets are encrypted with AES-256-GCM under a key derived from the server secret. Backup codes are stored as keyed hashes. Changing the email address or password, and deleting the account, requires the second factor while multi-factor authentication is on.

The library fields listed in the Privacy Policy are encrypted with AES-256-GCM. The library key is wrapped to the password with scrypt, and it is also wrapped to a key held on the server so that an email password reset can still open the library. The operator of the server can decrypt the library. This is not end-to-end encryption. Display names, email addresses, reader settings, profile pictures, reading progress, and reminder times are not inside that encryption.

When the server fetches a saved page, it refuses private, local, and link-local addresses, limits redirects, response size, and time, and sanitizes the article HTML before storing it. Sensitive routes, including sign-in, are rate-limited. Those counters live in memory and reset when the process restarts.

The Android app stores sign-in tokens in the device keystore, available after the device has been unlocked. A folder lock stores a bcrypt hash of the folder secret. A device biometric or device passcode used for that lock stays on the phone. Script updates downloaded through Expo are signed. Android packages are the files published on the GitHub release.

The official Android app permits cleartext HTTP, so it can talk to a server you host without TLS and so it can open an http page. ordo Cloud itself is served only over HTTPS.

7. How ordo Cloud is operated

The database is on a server in Germany. Axolet operates it from India and can decrypt the library from there.

TLS ends on that server. The listener allows TLS 1.2 and TLS 1.3 and sends HSTS. The application listens on the local interface, behind a reverse proxy on the same machine. Email verification is required, multi-factor authentication is optional, and one-time codes are not printed to the console. Account email goes through Resend.

The API access log, including IP address and request path, is rotated daily and kept for 14 days. A snapshot of the database taken before a software update may remain on the same server. Those files are not an off-site backup service, and they are not deleted on a schedule. Deleting an account does not erase a snapshot taken earlier.

These measures reduce risk. They do not mean ordo is free of vulnerabilities. Security also depends on a current app, an intact device, and, for a server you run, on the configuration below.

8. If you run the server

You decide who can reach the machine, whether TLS sits in front of it, who can read the database and the secret files, which mail server you use, when you apply updates, and how you back up. The server listens on the local interface unless you publish it. If SMTP is not configured, one-time codes are printed in the server console. ordo Cloud does not do that.

A folder lock is an in-app prompt. It is not a substitute for encrypting the disk.

9. Which versions receive fixes

Security fixes are made in the latest ordo app and the latest server release, unless a notice says otherwise. Older releases, and copies you have modified, may not receive a fix or any support. Install updates when they are offered.