Reporting a vulnerability

If you have found a security problem in GPUwerk, please tell GPUwerk before anyone else. Email [email protected], in English or Czech, with the subject line starting Security.

Include what you found, where (URL, endpoint or component), how to reproduce it, and what an attacker could do with it. Screenshots or a short proof of concept help. There is no PGP key: if the details are sensitive, send a short first message and agree how to share the rest.

Illegal content that a customer hosts on GPUwerk is a different matter: use the notice form for that.

In scope

• gpuwerk.com, console.gpuwerk.com, api.gpuwerk.com, platform.gpuwerk.com and status.gpuwerk.com;
• the isolation between customers' instances, and between an instance and GPUwerk's own systems;
• the software GPUwerk publishes for partner machines and its install images.

Out of scope

• websites and services that customers run on their own instances (a hostname like name.gpuwerk.com is a customer's);
• denial of service, load testing, spam, social engineering and physical attacks;
• third-party services GPUwerk uses, such as Stripe or the sign-in provider: report those to their owners;
• findings with no realistic security impact, such as missing headers on a static page or a self-XSS.

Rules for testing

• Use your own account and your own instances. Do not access, change or delete anyone else's data.
• If you reach another customer's data or GPUwerk's internal systems, stop, do not keep a copy, and report it.
• Do not degrade the service for others, and do not run automated scanners at a volume that does.
• Give GPUwerk reasonable time to fix the problem before you publish anything, and agree the timing with GPUwerk.

Safe harbour

If you follow the rules above in good faith, GPUwerk will treat your research as authorised, will not take legal action against you for it, and will not report you to the authorities for it. If a third party takes action against you over research that followed these rules, GPUwerk will say that it was authorised. This covers GPUwerk's own systems only, and cannot cover breaking the law in other ways.

What to expect

A person reads every report and replies. GPUwerk tells you whether it can reproduce the problem and when it is fixed.

There is no bug bounty. GPUwerk does not pay for reports.

The machine-readable version of this contact is at /.well-known/security.txt.