Security
Vulnerability disclosure policy
We welcome responsible reports of security issues in the Bstrapr control plane, connect helper, enrollment flow, and public site. Good-faith research helps keep customer Sites safer.
- Email support@bstrapr.com with subject “Security disclosure”
- Include steps to reproduce, affected component, and impact assessment if you have one
- Allow a reasonable time for investigation before public disclosure
- Do not access other customers’ data, disrupt service, or exfiltrate content beyond proof of concept
Scope
In scope: authentication and authorization flaws, enrollment/helper issues that could expand access beyond grants, tenant isolation failures, and sensitive data exposure in the control plane or public marketing site.
Out of scope for bounty-style research: social engineering of customers, physical attacks, and Denial-of-Service against production that harms other tenants. We do not currently run a paid bug bounty; we will acknowledge valid reports on this page when reporters agree to be named.
Acknowledgments
No public acknowledgments yet. Valid, coordinated reports will be listed here with the reporter’s preferred credit.