Responsible Disclosure Policy
1. Introduction
At Runa, we care deeply about security and value the work of independent researchers who help us keep data and systems safe. We welcome the good-faith reporting of security vulnerabilities in the assets covered by this policy, and we authorise security research carried out in accordance with it.
This Responsible Disclosure Policy (“Policy”) sets out what we consider good-faith research, what is in and out of scope, how to test safely, and how to report an issue to us. Please read it before you begin any testing.
2. Our commitment to you — authorisation and safe harbour
This section grants you authorisation to conduct security research within the limits of this Policy. It is the most important part of this document — please read it carefully.
| If you make a good-faith effort to comply with this Policy, Runa will: |
|---|
| • Consider your research to be authorised access for the purposes of the Computer Misuse Act 1990, and not a breach of any agreement you have with us; • Not initiate or support legal action against you in relation to that research; and • Work with you openly to understand and resolve the issue as quickly as we can. If, while acting in good faith, you inadvertently step outside this Policy — for example, you access data that is not yours — we will treat your actions as authorised, provided you stop as soon as you realise, tell us promptly, and do not use, save, or disclose that data. We will take your good-faith compliance into account in our response and will not treat honest mistakes as violations. |
This authorisation is limited to conduct that is within the scope defined in Section 3 and that follows the rules in Section 4. It does not authorise you to break any law or to infringe the rights of any third party, including our customers, their end-users, or our suppliers.
3. Scope
3.1 In scope
Active testing under this Policy is permitted only against the dedicated test environments we designate for security research:
- [Sandbox domain — e.g. sandbox.runa.io]
- [Dedicated API test environment — e.g. api-sandbox.runa.io]
Test accounts and access to these environments are available on request — see Section 5. If you would like to test anything not listed here, please coordinate with us first.
3.2 Out of scope
The following are out of scope for active testing. Please do not test, scan, or attempt to exploit them:
- Any production system, including systems that process live transactions, cardholder or payment data, or personal data;
- Runa corporate IT, internal tooling, and employee systems and accounts;
- Assets, services, or infrastructure hosted or operated by third parties on Runa’s behalf;
- Physical premises, data centres, and personnel;
- Any Runa product, domain, or sub-domain that is not expressly listed as in scope in Section 3.1.
If you believe you have found a vulnerability that affects a production system — whether through the test environment or otherwise — do not investigate it further on production. Report it to us straight away under Section 6 and we will look into it.
4. Rules of engagement
When carrying out research under this Policy, you must:
- Test only against the in-scope environments in Section 3.1. Active testing of any production system requires prior, written coordination with us (Section 5);
- Use only test accounts that you own or that we provide. Do not access, or attempt to access, accounts, data, or information that does not belong to you;
- Not run automated scanning, fuzzing, or high-volume or high-rate testing without our prior approval, and respect any rate limits that apply;
- Not take any action that could degrade, disrupt, or damage a service or another person’s experience — including denial of service, brute force, spam, or resource exhaustion;
- Not modify, destroy, or corrupt data or systems, and not attempt to do so;
- Stop and report to us immediately if you encounter personal data or other sensitive information (see below);
- Not conduct social engineering of any Runa employee, contractor, or service desk;
- Not conduct any physical or electronic attack against Runa personnel, property, premises, or data centres;
- Comply with all applicable laws and not breach any agreement in the course of your research; and
- Keep the details of any vulnerability confidential until we have agreed disclosure with you (Section 8).
| If you encounter personal data |
|---|
| Stop testing immediately. Do not access, copy, save, transmit, or disclose it. Record only the minimum needed to describe the issue, and report it to us without delay at security@runa.io. Protecting the privacy of our customers and their end-users is a condition of the protections in Section 2. |
5. Coordinating your research
| You never need our permission to report a vulnerability. |
|---|
| If you find something, please always tell us — reporting is always welcome and always protected under Section 2. |
You do need to coordinate with us before actively testing any production system. To request access to a test environment, a test account, or authorisation to test outside the default scope, email security@runa.io with a short description of what you would like to test and how. We will work with you to provide a safe way to do it.
6. Submitting a report
Please send reports to security@runa.io. So that we can evaluate and reproduce the issue quickly, please include:
- A description of the vulnerability, including clear steps to reproduce it and its potential impact on the user or service;
- The affected product, feature, component, or resource, including any relevant URLs;
- A proof of concept, or a reliable method that consistently demonstrates the issue, or logs that evidence successful exploitation; and
- Any specific configuration, conditions, or circumstances required to reproduce it.
We will acknowledge your report within five (5) business days.
7. What to expect
After we receive your report, we will stay in touch as we investigate, and we may ask you for additional information. We aim to validate reports promptly, keep you updated on our progress, and let you know once the issue is resolved.
8. Coordinated disclosure
We ask that you give us a reasonable opportunity to remediate an issue before any public disclosure. Please do not disclose a vulnerability, or any details of it, publicly or to any third party until we have confirmed it is resolved or we have agreed a disclosure timeline with you.
As a default, we work to a coordinated disclosure window of 90 days from the date we acknowledge your report, and we are always happy to discuss timing. We will not restrict disclosure unreasonably, and we are glad to credit researchers who would like to be named once an issue is fixed.
9. Non-qualifying vulnerabilities
The following generally do not qualify under this Policy unless you can demonstrate a specific, meaningful security impact. This list is not exhaustive:
- Best-practice suggestions or recommendations without a specific security impact;
- Email spoofing, and SPF, DKIM, DMARC, or other DNS configuration issues;
- Clickjacking on pages with no sensitive actions;
- Unauthenticated or logout CSRF;
- Vulnerabilities in third-party services not under Runa’s control;
- Vulnerabilities that do not, by themselves, expose a service or application to attack; and
- Issues with no real, meaningful security impact, as reasonably determined by Runa.
10. Changes to this Policy
Runa may modify or discontinue this Policy at any time at its sole discretion. The version in force is the one published at [trust.runa.io / policy URL]. Reports are assessed against the version of the Policy in force at the time of submission.
—————————————————————————————————————————————–
Contact
Security reports: security@runa.io | Trust Centre: trust.runa.io