Scope
This policy covers the persistentcompute.ai website and web console, the Persistent Compute apps, including the Mac and iPhone apps, the software we install on cloud computers, and the CloudFormation template we provide for running cloud computers in your own AWS account.
Services run by our providers, such as AWS, Tailscale, WorkOS, Stripe, and Cloudflare, are covered by their own disclosure programs. If an issue comes from how Persistent Compute uses one of them, it's in scope here.
How to report
Email security@persistentcompute.ai with the details. Please don't report security issues through support channels, public issue trackers, or social media.
What to include
Tell us which part of Persistent Compute is affected, such as a URL, an app and its version, or a template version; the steps to reproduce the issue; what an attacker could do with it; and any proof-of-concept code, screenshots, or logs that help us confirm it.
A short, clear report is fine. If you're not sure something is a security issue, send it anyway.
What we commit to
We'll acknowledge your report within 3 business days, keep you updated while we investigate and fix it, and tell you when it's resolved.
We ask that you give us 90 days from your report to fix the issue before you share it publicly. If we need longer, we'll explain why and agree a date with you. We're happy to coordinate disclosure once a fix is out.
Testing guidelines
Test only against accounts and cloud computers you own, or that you have the owner's permission to test.
Don't access, change, or keep other customers' data. If you come across someone else's data, stop, don't share it, and tell us what you saw.
Don't run denial-of-service or load tests, or anything else that degrades the service for other people.
Don't use social engineering, phishing, or physical attacks against our staff, customers, or providers.
Safe harbor
If you research and report in good faith and follow this policy, we'll consider your research authorized. We won't take legal action against you or ask law enforcement to, and we won't treat it as a breach of our Terms of Service.
If you're unsure whether something you want to try is allowed, ask us first.
Rewards
We don't run a bug bounty program at this time, so we can't offer payment for reports.