Security

Scope

This disclosure process covers the open-source Akter framework and Akter Cloud, including the hosted console, API, edge, customer runners and store access. For a framework issue, include the package version and runtime. For a hosted issue, include the affected service and region if known.

What to send

Describe the issue, its impact and the smallest safe reproduction. Include relevant versions, timestamps, request identifiers and a way to contact you. Redact credentials and personal data. Do not put a working exploit or sensitive data in a public GitHub issue.

Safe testing

Only test accounts, applications and data you control or have explicit permission to test. Do not access another customer's data, disrupt service, scan broadly, send spam, perform denial-of-service testing or persist access. If you encounter another person's data, stop and report what you observed without copying more of it.

Coordinated disclosure

We will investigate reports and coordinate a fix and public disclosure with the reporter. Please keep the details private while we investigate and agree on a disclosure timeline. This policy is a reporting channel, not authorization for intrusive testing or a promise of a bounty or response-time SLA.

Other requests

Account and product-support requests belong at support@akter.dev. Machine-readable disclosure contacts are available in security.txt.