If you think you've found a vulnerability in The One Stack, Hub for MSPs, or THEO, submit a request in this Help Center and mark it as a security report.
What to include
- What the issue is and where you found it
- Steps to reproduce it and the likely impact
- Any proof of concept (please don't exploit the issue beyond what's needed to show it)
What we ask
- Give us a reasonable opportunity to investigate and address the issue before you disclose it publicly.
- Only test against accounts you own or have explicit permission to use. Don't access, change, keep, or remove data that isn't yours, including other customers' data. If you encounter such data, stop and tell us.
- Don't run denial-of-service tests, social-engineer our staff or customers, or test physical security.
- Don't test systems that belong to our customers or to third-party vendors; we can't authorize testing of systems we don't own.
What to expect
We may contact you if we need more information. We don't commit to a specific response time.
We don't run a bug bounty program. Submitting a report doesn't entitle you to payment or any other reward.
For live incidents and outages, see status.theonestack.com.
This article describes The One Stack's practices as of the "last reviewed" date below. It is provided for general information only. It is not a contract, warranty, certification, or guarantee of any security outcome, and it does not change the terms of any agreement between you and The One Stack. Our practices may change over time. Last reviewed: 2026-10-28.