Responsible disclosure
If you discover a security vulnerability in Gazebo, please report it responsibly. We take all reports seriously and will respond promptly.
How to report
Email: [email protected]
Please include:
- A description of the vulnerability
- Steps to reproduce
- The potential impact (what an attacker could do)
- Any proof-of-concept code or screenshots (if applicable)
We ask that you do not publicly disclose the vulnerability until we've had a chance to investigate and release a fix.
What to expect
- Acknowledgement within 24 hours of your report
- Initial assessment within 72 hours — we'll confirm whether the report is valid and its severity
- Fix timeline communicated once the severity is assessed — critical issues are addressed immediately; lower severity issues are scheduled in the next release cycle
- Credit — we'll acknowledge your contribution in the fix notes if you'd like
Scope
In scope:
- Authentication and authorization bypasses
- Credential leakage — any path that returns a plaintext credential to an unauthorized party
- Privilege escalation — accessing another user's vault, agents, or audit logs
- MCP or REST API vulnerabilities
- Injection vulnerabilities in any user-controlled input
Out of scope:
- Rate limiting or denial of service
- Theoretical vulnerabilities without demonstrated impact
- Issues requiring physical access to infrastructure
- Social engineering attacks
Bug bounty
We do not currently operate a formal bug bounty program, but we recognize significant contributions with acknowledgement and Gazebo credits.