Reporting a security issue
How to reach us
Mail security@hyperspool.com, in English or Swedish. Say what you found, where, and the steps that show it. Keep the details out of public issues and forums until we have fixed it.
What we want to hear about
- Reading or changing another org's runs, logs, artifacts, secrets or settings.
- Getting past sign-in, a role check, or a webhook's signature.
- A workflow or agent reaching something it was not given: another run's secrets, the control plane's hosts, other customers' build machines.
- Injection, request forgery, or script running in the console.
- Secrets or tokens showing up where they should not: logs, error messages, URLs.
While you look
- Use an org of your own. Never access, change or keep other customers' data; if you reach some by accident, stop, and tell us what you saw.
- No denial of service, load testing or spam, and nothing that degrades the service for others.
- No phishing or social engineering of our staff or users.
- Give us a reasonable time to fix a problem before you talk about it.
What happens next
We reply within three working days to say we have your report, and keep you told as we work on it. Once it is fixed we are glad to credit you, if you want to be named.
This page is also published as /.well-known/security.txt.