Security reporting

Reporting a vulnerability

Please do not open a public issue for security vulnerabilities.

Report privately by email to [email protected]. Encrypt the report if you can and say so in the first message; we will arrange a key exchange before any sensitive detail is sent.

Please include:

• A description of the issue and its impact.
• Steps to reproduce (a minimal request/response, or a short PoC).
• The affected version / commit, and your environment if relevant.

You can expect an initial acknowledgement within a few days. Once a fix is available, we will coordinate a disclosure timeline with you.

Scope

This API executes Exchange Online PowerShell cmdlets on behalf of authenticated callers. Reports that are especially in scope:

• Authentication / authorization bypass (OAuth scope or app-role enforcement, the per-endpoint auth policies).
• The cmdlet allowlist - any way to invoke a cmdlet that is not on the allowlist, or to pass parameters outside a write endpoint’s permitted set.
• Injection into the PowerShell pipeline (OPATH filter pushdown, parameter binding).
• Secret handling (tokens must never be written to disk; the app acquires them in-memory only).
• Rate-limiter / runspace-pool denial-of-service.
• The license validator (src/ExchangeApi.Web/Licensing/): accepting an unsigned or wrongly-signed license key, or bypassing the tenant binding, without editing or recompiling the source.

Out of scope

• Findings that require already-compromised tenant admin credentials.
• The bundled Microsoft documentation submodule (Wiki/office-docs-powershell), which is upstream Microsoft content.
• Circumventing the plan check by modifying the source you run yourself. This is a licensing matter under the license, not a security vulnerability.

Handling secrets

This repository must never contain real tenant identifiers, credentials, or personal data. Configuration secrets are supplied at runtime via .NET user-secrets or environment variables and are .gitignored. If you discover committed secrets, please report them to [email protected].