VDP · activev1.0updated 2026-06-17machine-readable: /.well-known/security.txt

Security & coordinated disclosure.

If you've found a security issue in EcoCloud, we want to hear from you. This page is the canonical policy referenced by our security.txt — it tells you exactly what's in scope, how to report, what we commit to in return, and the safe-harbor terms that protect good-faith research.

How to report

Email [email protected] with enough detail for us to reproduce: the affected endpoint or page, a clear description of the issue and its impact, and a minimal proof-of-concept (request/response, steps, or a short script). Encrypt sensitive details if you prefer — ask in your first message and we'll arrange a channel.

[email protected] 📄 security.txt 🔑 receipt-signing JWKS

Please include a way to contact you for follow-up. If you'd like public credit, say so and tell us the name/handle to use — see acknowledgments below.

Scope

In scope

  • The landing & API surface at ecoclouddev.com, including /api/v1/*
  • The application at app.ecoclouddev.com
  • The MCP server at /mcp (JSON-RPC over HTTP)
  • Agent-key authentication, scope enforcement, rate limiting, and the per-workspace constitution
  • The tamper-evident audit chain and ECDSA receipt verification
  • Authorization / IDOR, injection, auth bypass, secret exposure, and SSRF in the above

Out of scope

  • Volumetric / network DoS and brute-forcing rate limits (please don't — test logic, not load)
  • Findings that only affect our upstream providers (Cloudflare, Supabase) — report those to them; we'll help coordinate
  • Social engineering, phishing, or physical attacks against EcoCloud staff or users
  • Missing best-practice headers with no demonstrated impact, or automated-scanner output without a working PoC
  • Self-XSS, clickjacking on pages with no sensitive action, or issues requiring a rooted/MITM'd device
  • Spam, content, or non-security bugs (those go to [email protected])

Test only against your own workspace, accounts, and agent keys. Never access, modify, or retain data that isn't yours. If you stumble onto someone else's data, stop, and tell us — that itself is a valid report.

Our response commitments

We're an early-stage product, but coordinated disclosure deserves a real SLA. Business days, from when your report reaches [email protected]:

StageTarget
Acknowledge receiptwithin 2 business days
Triage & initial severity assessmentwithin 5 business days
Progress update cadence until resolvedat least every 7 days
Coordinated public disclosureby mutual agreement, default 90 days after triage

Remediation targets by severity

SeverityExampleFix target
CriticalAuth bypass, cross-workspace data access, RCE, agent-key forgery≤ 7 days
HighPrivilege escalation within a workspace, constitution bypass on writes≤ 30 days
MediumStored XSS in low-privilege view, audit-log integrity gap≤ 60 days
LowInfo disclosure with limited impact, rate-limit edge casesbest effort

We don't currently run a paid bug-bounty. Reports are rewarded with public credit and our genuine thanks — we'll be upfront about that rather than imply a payout that doesn't exist.

Safe harbor

We support good-faith security research. If you make a good-faith effort to comply with this policy during your research, we will:

"Good faith" means: you stay within scope, you stop at the minimum proof needed, you don't access or destroy others' data, you don't degrade service, and you give us reasonable time to remediate before any public disclosure. If legal action is brought against you by a third party for activity that complied with this policy, we'll make our authorization known.

Acknowledgments

Researchers who have responsibly disclosed valid issues — with their permission — are credited here. No external disclosures yet. Be the first: a confirmed in-scope report earns a permanent entry on this page.

Verify this policy & our receipts

The machine-readable counterpart of this page lives at /.well-known/security.txt. Separately, EcoCloud audit receipts are signed with an ECDSA P-256 key whose public half is published as a JWKS at /.well-known/flowdesk-signing-key.json — anyone can verify a receipt's signature in the browser with the Web Crypto API. See the verifiable-receipts demo on the showcase, and the Trust & security overview.

// the governed loopsimulateconstitutionexecutesignedverifyES256 · audit-chained