Get early access
Home · Security

Security & responsible disclosure

Found a vulnerability? Tell us before you tell the world. Below: the contact, the rules, what we'll do, and how we run security inside HostAtlas.

Last updated: 2026-05-07 Contact: security@hostatlas.app

How to report

Email security@hostatlas.app with a clear description of the issue, steps to reproduce, the affected endpoint or component, and the impact you believe it has. Include your handle if you want public credit.

Acknowledgement We acknowledge every report within 24 hours (Mon–Fri). Initial triage within 3 business days. Reports made on weekends or US/EU holidays may take an additional day to land.

If you need encrypted communication, request our PGP key in your first message — we'll provide it in reply. We don't publish the key online to avoid stale-key issues; sending the key on request guarantees you have the current rotation.

Scope

In scope

  • my.hostatlas.app — the web application
  • hostatlas.app — the marketing site
  • Public APIs at my.hostatlas.app/api/v1/*
  • The HostAtlas agent binary distributed via our installer
  • The HostAtlas CLI binary
  • The HostAtlas SSH desktop client

Out of scope

  • Third-party services we depend on (Hetzner, Cloudflare, Polar.sh, Sentry, Mailgun, Groq) — report directly to those vendors
  • Customer-controlled servers running the agent (the customer owns the host security boundary)
  • Social engineering of HostAtlas staff or users
  • Physical attacks on offices or staff
  • Reports without a credible exploitation chain (e.g. “missing CSP” without a concrete impact path)
  • Volumetric DDoS — we have rate limits, please don't test them

Rules of engagement

We treat good-faith security research as authorised testing under our Acceptable Use Policy. To stay within those rules:

  • Test only your own account. Create a free-tier account if you don't have one.
  • Do not access other tenants' data. If a vulnerability would allow it, demonstrate it on data you control.
  • Do not run automated scanners against production endpoints. Hand-crafted requests are fine.
  • Don't exfiltrate, modify, or destroy data beyond what's necessary to demonstrate the issue.
  • Don't publicly disclose until we've had reasonable time to fix (90 days for high-severity, longer if mutually agreed).
  • One report per issue. Don't chain reports of the same root cause across endpoints.

We will not pursue legal action against researchers who follow these rules in good faith and report through security@hostatlas.app.

What we will do

  • Acknowledge the report within 24 hours.
  • Triage within 3 business days, with a severity rating you can agree or push back on.
  • Communicate a fix timeline based on severity:
    • Critical: patched within 7 days
    • High: patched within 30 days
    • Medium: patched within 90 days
    • Low / informational: next applicable release
  • Credit you (handle, full name, link of your choice — or anonymous) in our hall of thanks if you want.
  • Notify affected customers if their data was at material risk, in line with our Privacy Policy and applicable breach-notification laws.

We do not run a paid bug bounty programme at this time. We may offer swag for high-quality reports that are clearly above-and-beyond.

How we run security

Short, honest version of what we actually do. We'll add concrete attestation reports here as we obtain them.

Identity & access

  • SSO / 2FA enforced for all internal systems with privileged access.
  • Customer accounts support TOTP and WebAuthn 2FA.
  • SSO / SAML available on Enterprise.

Tenant isolation

  • Every database query goes through tenant scoping at the model level — no cross-tenant data leak by design, enforced in code, audited automatically.
  • Per-tenant Certificate Authority for SSH Gatekeeper, encrypted at rest.

Data & encryption

  • TLS 1.2+ everywhere. HSTS preload-eligible.
  • Customer secrets (provider tokens, MCP credentials) encrypted at rest with our application key.
  • Off-site backups encrypted client-side on the agent. Our service never sees plaintext backup data.
  • Off-site Ransomware Gate refuses high-entropy uploads — see Ransomware Gate.

Audit & observability

  • Audit log records every administrative and customer-impacting action.
  • Internal access to production data is itself audited and reviewed.
  • Errors are surfaced via Sentry (no PII or secrets are logged).

Supply chain

  • Sub-processors are listed in our privacy policy; that page is the source of truth.
  • Agent and CLI binaries are built reproducibly and tagged with version + commit.
  • Dependency updates are reviewed; security advisories tracked.

Abuse, takedowns, copyright

For abuse reports about a HostAtlas-hosted resource (*.hostatlas.app), email abuse@hostatlas.app.

For DMCA-style copyright claims, email dmca@hostatlas.app with the elements required under 17 U.S.C. § 512(c)(3): identification of the copyrighted work, identification of the infringing material with a URL, your contact information, the standard good-faith and accuracy statements, and your physical or electronic signature. We will register a designated DMCA agent with the U.S. Copyright Office; until that registration completes, the email above remains the canonical contact.

Hall of thanks

Researchers who've reported issues responsibly will be listed here as we accumulate reports. If you've reported and want to be listed, mention it in your email.

(No reports yet — be the first.)