How to report a security issue, and what we promise in return
Vulnerability disclosure policy
Scope, safe harbour and response timelines for reporting a security vulnerability to runnerhut.
Updated 2026-08-14
If you have found a security issue, we want to hear about it and we will not pursue you for telling us in good faith.
How to report
security@runnerhut.com, encrypted with our published PGP key if the finding is sensitive. The same address is listed in /.well-known/security.txt.
What we commit to
- Acknowledgement within one business day
- An initial assessment with severity and expected timeline within five business days
- Progress updates at least every ten business days until resolution
- Credit in the advisory if you want it, and none if you do not
Safe harbour
We will not pursue legal action for research conducted in good faith under this policy: testing only against your own account, stopping at proof of access rather than extracting data, not degrading the service for others, and giving us reasonable time to fix before disclosing.
Out of scope
- Denial of service, volumetric or otherwise
- Social engineering of our staff or customers
- Findings that require physical access to our facilities
- Missing security headers with no demonstrated impact
Your next build could be twice as fast, at half the price
Start free. Migrating away is the same one line, and we publish that diff too.