Target for confirming receipt of a security report.
Target for impact review and determining whether a report is accepted.
Accepted reports receive progress updates at least weekly.
Target for notifying affected customers after confirming a material customer-data incident.
How to contact us
The preferred path is email. If you use the contact form, include Security report in the subject or message so it is triaged correctly.
Primary channels
What to include
- Affected URL, endpoint, worker, or workflow
- Clear reproduction steps
- Expected impact and any prerequisites
- Sanitized logs, screenshots, or proof-of-concept details
- Whether customer data was accessed, modified, or exfiltrated
What is covered
We care most about bugs that could expose customer data, weaken access control, compromise the control plane, or undermine the default managed VPS security model.
In scope
ekuri.aiand first-party subdomains- Pages Functions under
/auth/*and/api/* - VPS worker and manage-api control plane code in this repository
- Managed VPS provisioning, update, backup, restore, and access-control paths
Out of scope
- Social engineering, phishing, spam, or physical attacks
- Denial-of-service testing
- Third-party vulnerabilities with no Ekuri-specific exploit path
- Attacks requiring credentials or account access you do not own
- User-modified self-hosted environments outside Ekuri-managed infrastructure
Researcher safe harbor and incident handling
We want responsible research, not theatrical exploitation. If you act in good faith, avoid privacy violations, and report promptly, we will treat your work as authorized.
Safe harbor
- Stop once you have enough evidence to demonstrate the issue
- Do not exfiltrate, retain, or publicly expose customer data
- Do not modify or destroy data you do not own
- Do not disclose publicly before we have had a reasonable chance to remediate
Incident communication
- Acknowledge reports within 48 hours
- Provide an initial triage result within 5 business days
- Send weekly updates for accepted reports
- Target customer notice within 72 hours of confirming a material customer-data incident
Related public artifacts
We publish the documents and repository artifacts we expect reviewers to inspect.