Vulnerability disclosure policy
If you believe you have found a security vulnerability in Bucker, we want to hear about it and we will not take action against you for looking in good faith. This page says how to tell us, what you can expect back, and what is in scope.
Status: draft policy, not yet reviewed by counsel. The safe-harbour wording in particular is the operating entity's to confirm. That entity is Atilan LLC, a Wyoming limited liability company, which owns and operates Bucker; it has not yet confirmed this wording. Until it does, treat the commitments below as engineering's good-faith statement of intent. There is no bug bounty.
How to report
Email security@bucker.io. Plain text is fine. Please include:
- what you found and where (URL, route, or the file and line if you have read the source);
- the steps to reproduce it, or a proof of concept that does the least harm that demonstrates it;
- what you think an attacker could do with it;
- how you would like to be credited, if at all.
If you would like to encrypt your report, ask for a key in a first message that contains no details. Please do not open a public issue or post details elsewhere until we have fixed it or agreed a date.
The same address and the policy URL are published in machine-readable form at
/.well-known/security.txt (RFC 9116).
What to expect
| When | What we do |
|---|---|
| Within 3 business days | We acknowledge the report and tell you who is handling it |
| Within 10 business days | We tell you whether we consider it a vulnerability, and our severity rating |
| Then | We keep you informed. Critical issues are fixed or mitigated within 72 hours, high within 14 days, medium within 60 days |
| After the fix | We tell you, and credit you if you want it. We aim to coordinate publication with you; our default is within 90 days of your report |
These are the targets in the vulnerability management policy, which is a draft; they are what we hold ourselves to, not a contractual commitment.
Scope
In scope:
bucker.io,www.bucker.io,app.bucker.io,status.bucker.ioapi.bucker.io,us.api.bucker.io,us.ingest.bucker.io,mcp.bucker.io- The open-source SDKs
Of particular interest, because they are what customers trust us with: a way to read or write another tenant's data; a way around the human-approval gates (anything that lets an agent or an unauthenticated caller merge, approve or deploy); bypass of the scrubbing that removes personal data before storage or before a model; disclosure of a secret; an SSRF that reaches private ranges.
Out of scope:
- Findings that need a rooted device, a compromised account or physical access
- Denial-of-service by volume, and automated scanner output with no demonstrated impact
- Missing best-practice headers or cookie flags without a working attack
- Social engineering of our staff or customers, and anything involving a third party's systems (Vercel, Fly.io, Cloudflare, your own SDK host) that is not ours to authorise
Rules of engagement
- Test only against accounts you own. Never access, modify or keep other people's data; if you reach some by accident, stop and tell us.
- Do not run tests that degrade the service for others. Keep automated traffic low.
- Do not extort, and do not disclose the vulnerability to anyone else before we have had a chance to fix it.
Safe harbour
If you follow this policy, we will consider your research authorised, we will not pursue or support legal action against you for it, and if a third party brings a claim we will say that you acted within this policy. This does not authorise anything unlawful beyond what testing under the rules above requires. Counsel has not reviewed this paragraph.
Hall of fame
We have not yet received a report, so there is nobody to thank. If you are first, you will be here.