Reporting a security issue

How to report

Email security@cloudrf.xyz. Please include what you found, where, the steps to reproduce it, and what an attacker could do with it. Screenshots or a short proof of concept help. Please don't post the details publicly until we have had a chance to fix it.

What is in scope

• sentineloss.cloudrf.xyz — the SentinelOSS web app and its API

Not in scope: reports that only list missing best-practice headers without a working attack, denial of service, spam or social engineering, and issues in third-party services we use (report those to their owners).

What we ask

• Test only against your own account and data. Never access, change or delete other people's data.
• Don't degrade the service for others — no load testing, flooding or automated mass scanning.
• Stop and report as soon as you have shown the issue exists; don't go further than you need to.
• Give us reasonable time to fix it before disclosing publicly — normally up to 90 days.

What you can expect

• A reply within 7 days confirming we received your report.
• Updates while we investigate and fix it.
• Credit when the fix ships, if you would like it.
• We will not pursue or support legal action against anyone who reports in good faith and follows the rules on this page.

There is no paid bug bounty at the moment.