Vulnerability disclosure

Scope

This policy covers what we run and ship:

anturno.cloud, the marketing site. app.anturno.cloud, the workspace. api.anturno.cloud, the public API and the MCP server. The anturno device daemon, which runs as the anturno command. The anturno macOS tray app.

Out of scope: services run by our subprocessors and by the tools you connect, which have their own programs (the subprocessor list names them); other hosts and domains; denial-of-service or load testing; spam, phishing or social engineering of our people or customers; physical attacks; and findings that need a rooted device, a compromised browser or access to a victim's session.

How to report

Write to security@anturno.cloud. Plain email is fine. If your report holds something sensitive and you want it encrypted, say so in a first message and we will arrange a channel.

Include what you found and where, the steps to reproduce it, what an attacker could do with it, the version or build if it concerns the daemon or the tray app, and how to credit you if you want credit. A short report with a working reproduction helps more than a long one without.

Please do not use hello@anturno.cloud or a support request for a vulnerability.

What you can expect

We acknowledge your report within five business days. We then tell you whether we consider it a vulnerability, and we keep you informed while we fix it.

We ask you to keep the details private until the issue is fixed, or until ninety days after your report, whichever is first (see disclosure below).

With your agreement we credit you in the fix's release notes. We do not run a bug bounty and do not pay for reports.

Safe harbour

We will not take legal action against you, or ask law enforcement to, for security research on the services in scope that follows this policy. If a third party starts an action against you for research that followed it, we will say that it was authorized.

To stay inside it:

Make a good-faith effort not to read, change, keep or share data that is not yours, and stop and tell us as soon as you reach another person's data. Test only against accounts and workspaces you own or have the owner's permission to use. Do not degrade the service for others, and do not use a vulnerability to pivot into other systems. Do not disclose the issue to anyone else before the date below. Follow the law that applies to you.

This policy does not authorize research against anything outside the scope above, and it cannot bind other organizations whose systems you may reach.

Disclosure

We practice coordinated disclosure. We aim to fix a confirmed vulnerability and tell the people affected well inside ninety days of your report. You may publish your findings once it is fixed, or ninety days after your report, whichever is first. If we need more time for a complex fix we will tell you why and agree a date with you, and we ask you to hold off until then.

Everything else

This page is published at https://anturno.cloud/vulnerability-disclosure, and a machine-readable pointer to it is at https://anturno.cloud/.well-known/security.txt. Questions about the policy itself go to security@anturno.cloud.