rarecloud
TRUST CENTER

Responsible Disclosure

Found a vulnerability? Tell us first.

We welcome reports from security researchers and customers. Write in English or Romanian, and include what you found, where, the steps to reproduce it and what an attacker could do with it.Machine-readable contact: security.txt

security@rarecloud.io

What Happens After You Report

  1. You report

    Email security@rarecloud.io with what you found and how to reproduce it.

  2. We confirm receipt

    We aim to confirm receipt within 3 business days, with a person you can reply to.

  3. We assess it

    We aim to tell you within 10 business days whether we can reproduce it and how serious we think it is.

  4. We fix it and tell you

    We keep you updated until it is fixed, and credit you once it is, if you would like that. Credit goes to the first person to report an issue.

We do not run a paid bug bounty.

In scope

  • rarecloud.io, including the client area and billing pages
  • console.rarecloud.io and api.rarecloud.io
  • Cloud services you use from your own account: Cloud VMs, managed Kubernetes, block storage and load balancers
  • Our open-source tools on GitHub: the rarecloud CLI, the Terraform provider and the MCP server

Out of scope

  • Websites and servers that our customers run on our network. To report abuse from one, email hello@rarecloud.io.
  • Services run by other companies, such as payment processors. If you are not sure who runs something, tell us and we will pass it on.
  • Denial of service, load tests and anything that degrades a service for others
  • Social engineering, phishing or physical attempts against our staff, our customers or the data centers we use
  • Issues we already know about, or that someone else has already reported
  • Automated scanner output, or missing best-practice settings, without a shown security impact

Testing rules

  • Test only against accounts and resources that you own, or that their owner has allowed you to test.
  • Do not access, change or delete other people's data. If you reach any by accident, stop, do not keep it, and tell us in your report.
  • Do not scan our IP address ranges. Test only the hostnames listed in scope.
  • Do no more than you need to show the issue.
  • Give us a reasonable time to fix the issue before you share it with anyone else, and agree a date with us.

Safe harbor

If you act in good faith and follow this policy, we consider your research authorized. We will not take legal action against you over it, and we will not ask law enforcement to act against you. If a third party takes legal action against you over research that followed this policy, we will make it known that your research was authorized by us. This policy cannot authorize testing of systems run by other companies, and it does not change what the law requires us to report, for example a personal data breach to the data protection authority.