We welcome reports from security researchers. If you believe you have found a vulnerability in Cerberon, please tell us so we can fix it.
How to report
Email security@cerberon.dev with:
- what you found and where, including the affected version or address,
- steps to reproduce it, and any proof of concept,
- the impact you believe it has, and
- how you would like to be credited, if at all.
Scope
In scope: the Cerberon software and installer, cerberon.dev, docs.cerberon.dev and license.cerberon.dev.
Out of scope: denial of service, spam, social engineering, physical attacks, attacks on other customers’ instances, reports from automated scanners without a demonstrated impact, missing best-practice headers without an exploit, and third-party services we use.
Our commitment
- We acknowledge your report within 3 working days.
- We keep you updated at least every 10 working days until it is resolved.
- We aim to fix confirmed critical issues within 30 days and others within 90 days.
- We credit you publicly once a fix is released, if you wish.
We do not currently pay bug bounties.
Safe harbour
If you act in good faith under this policy, we will not take legal action against you or ask the authorities to. Good faith means you:
- test only within the scope above,
- avoid accessing, changing or keeping other people’s data, and stop as soon as you reach it,
- do not degrade our services,
- give us reasonable time to fix the issue before telling anyone else, and
- do not demand payment in exchange for the details.
Our machine-readable contact is at /.well-known/security.txt.