Hunt our own code. Responsible disclosure, public credit.
Researchers are welcome to look at the platform itself. Report what you find, we fix it, and with your consent we credit you in the Hall of Fame. We do not pay for findings.
What is in and out of scope.
In scope
Out of scope
How we rate what you find.
Severity decides how fast we fix. It does not change what you get: every valid report is credited, and none is paid.
| Severity | Examples |
|---|---|
| Critical | Remote code execution against the control plane; cross-tenant data exposure; weight-signing key compromise. |
| High | Authentication bypass; significant authorisation flaw; recovery of secrets from logs or storage; CSRF on a sensitive action. |
| Medium | Reflected XSS with practical impact; SSRF against an internal but non-sensitive surface; lesser tenant-data leaks. |
| Low | Self-XSS with a believable trigger; rate-limit weaknesses; minor information disclosure; misconfigurations with limited impact. |
| Informational | Best-practice findings, hardening suggestions, theoretical issues without a working PoC, and useful research write-ups. |
Duplicates are credited to the first reporter. Aggregated low-severity findings may be combined at our discretion.
Four steps, one inbox.
- 01
Reproduce in your own sandbox
Sign up for a free sandbox tenant and work only against resources you own. Do not test against another customer's tenant or production data under any circumstances.
- 02
Email security@safeguard.sh
Send a detailed write-up: affected component, reproduction steps, impact, and your PGP key if you want encrypted correspondence. Include a working PoC where applicable.
- 03
Acknowledge within 1 business day
We acknowledge inbound reports within one business day. You will hear from a Safeguard security engineer, not an autoresponder, with the next steps and an internal tracking ID.
- 04
Triage, fix, public credit
We triage, agree a remediation timeline, ship the fix, and publish public credit in the Hall of Fame with your consent and chosen handle.
Credit where it is due.
Credited on every fix
The hall of fame is updated once a fix ships, with researcher consent. We use the handle, attribution and link you specify, or no attribution at all if you prefer to stay private.
It also lists honourable mentions, and the breach claims that turned out to be one of our decoy sandboxes. For technical write-ups of remediated findings, by us and by researchers, see /research. We publish the analysis once the fix is in customer hands.
Good-faith research is protected.
Our commitment
Good-faith researchers operating within this programme are not pursued legally by Safeguard. We will not initiate or support legal action against researchers who respect scope, avoid disruption of customer environments, and report findings to security@safeguard.sh.
Safe harbour does not cover public disclosure before a fix, or false claims about our security in any medium. The full terms, including the legal notice on unlawful disclosure and defamation, are in the Responsible Disclosure Policy.
Found something? Tell us.
One business day to acknowledge. A real engineer in the loop. Public credit, and a fix that lands.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.