Reporting a security problem

Email security@runners.io. Say what you found, the steps that reproduce it, what an attacker could do with it, and the account or organisation you tested from. A short report we can reproduce is worth more than a long one we cannot.

Please do not put the details in a GitHub issue, a support request or anywhere public until we have fixed it. The same address is in our security.txt.

• this website, the dashboard and its API, at www.runners.io;
• the CI runners: the virtual machine a job runs in, the network around it, and the caches it is given (cache.runners.io and layers.runners.io);
• the GitHub App and the control plane behind it, at cp.runners.io;
• the Terraform service at tf.runners.io.

A way out of the virtual machine, or into another customer’s job, cache, state or account, is the most valuable thing you can tell us.

• denial of service, load testing, or anything that degrades the service for others;
• social engineering, phishing, or physical attacks on anyone;
• the services we use, such as GitHub or Stripe: report those to them;
• findings from automated scanners with no demonstrated impact;
• using a job to attack, scan or mine on anyone else’s systems, which our terms forbid whatever the reason.

Test only with accounts and organisations you own. If you reach another customer’s data, stop, do not keep or share it, and tell us what you saw. Do not change or delete anything you do not own. Keep what you run to what you need to show the problem.

If you act in good faith and within this policy, we will not take legal action against you or ask anyone else to, and we will not close your account for the research. If something you want to try is not covered here, ask us first at the same address.

We acknowledge a report within three working days and tell you whether we can reproduce it. We keep you told as we fix it, and say when it is fixed. We ask that you wait for the fix, or 90 days from your report, before publishing; if we need longer we will say why. We will credit you when it is published, if you would like that.

We do not run a paid bug bounty.