Report a security vulnerability

If you believe you've found a security weakness in InfraNest, this article explains how to tell us, what to include, and what you can expect in return. It's for anyone — customers, researchers, or curious tinkerers — who wants to report a problem responsibly.

#Overview

• InfraNest takes security reports seriously and reviews every one we receive.
• Reporting responsibly helps us fix problems quickly, before they can be misused.
• We welcome good-faith research and won't take legal action against reports made in line with this article.

#Report a vulnerability

1. Email your report to security@infranest.io.
2. Do not open a public GitHub issue or post about the problem anywhere before we've had a chance to fix it.
3. In your email, include:
   • what you found, and what someone could do with it;
   • how to reproduce it — the page or address, the steps you took, and any requests or screenshots;
   • whether you'd like to be credited, and under what name.
4. Write in English, Dutch, or German — whichever is easiest for you.

WarningNever run load testing or denial-of-service attempts against the live service, even to prove a point.

#What happens next

1. We confirm we've received your report within 3 working days.
2. We let you know how serious we think the issue is, and what we plan to do about it, within 7 working days.
3. We keep you updated as we work on a fix.
4. Once the fix is live, we credit you for the find — unless you'd rather stay anonymous.

#What's in scope

• The InfraNest app and its API (*.infranest.io).
• The server agent, infranest-agent, and the data it sends.
• Anything that lets one workspace see or change another workspace's data, servers, or settings.
• How we store and use the keys and tokens you connect.

#What's out of scope

• Problems that require someone to already control your computer or server, or to have physical access to it.
• Raw automated scanner output with no working proof of concept.
• Best-practice suggestions with no concrete security impact.
• Social engineering — tricking our team or our customers.
• Load or denial-of-service testing against the live service.

#Research in good faith

We won't take legal action against you, or ask anyone else to, as long as you:

1. Make a genuine effort to follow the guidance on this page.
2. Avoid harming anyone's privacy, deleting data, or slowing down the service.
3. Look at no more of another workspace's data than you need to demonstrate the problem, and delete it afterwards.
4. Give us reasonable time to fix the issue before telling anyone else about it.

TipThe safest way to test is against your own workspace — you can create one for free.

#Tips

• This email address is only for security reports. For anything else — a bug, a question, or a billing issue — contact support from within the app instead.
• Our published contact details are also available at https://infranest.io/.well-known/security.txt.