Security

How to report

Email hello@autodeploy.fyi with what you found, the steps to reproduce it, and its impact. I aim to acknowledge reports within 3 days and to keep you updated until it is fixed.

In scope

• the dashboard (app.autodeploy.fyi) and the API;
• the edge that serves sites under autodeploy.fyi;
• the build sandbox and server-rendered app runtime, including any way to reach another user’s data, secrets or sites.

Problems in a site someone deployed on AutoDeploy belong to that site’s owner; report those to them. Problems in third-party providers belong to those providers.

Rules for testing

• Test only with your own account and projects.
• Don’t access, change or keep other people’s data.
• No denial of service, spam, social engineering or physical attacks.
• Give me a reasonable time to fix the issue (up to 90 days) before disclosing it.

If you follow these rules, I won’t pursue legal action over your research. AutoDeploy is a free project, so there is no paid bug bounty, but I will gladly credit you.