How to report
Email zarif.latif@railo.dev with “Security report” in the subject line. Please report privately in the first instance rather than opening a public issue.
What to include
- What you found, and the impact you believe it has.
- The steps to reproduce it, including the URL or endpoint and roughly when you tested.
- Anything that helps us tell your test apart from normal traffic: a request id, a screenshot, a short recording.
What not to include
Please do not send live credentials, customer data, or third-party source code. If a credential is involved, say that one is involved and rotate it; do not paste it into the report.
What to expect
We aim to acknowledge a report within 2 business days, and to tell you what we found and what we are doing about it. Response times are best-effort rather than contractual; see Support.
Please avoid
- Denial-of-service testing, load testing, or anything else that degrades the service for other people.
- Accessing, changing, or extracting data that is not yours. Test against your own repositories.
- Social engineering of our users or our staff.
If your question is about data handling
Security and data handling covers what Railo touches and what it never does, and the Privacy Policy is the formal statement.