RELAY
Security
How to report a vulnerability in Relay, and what to expect from us.
We welcome reports from security researchers and customers. If you believe you have found a vulnerability in Relay, email security@userelay.sh. Please do not open a public issue or disclose it before we have had a chance to fix it.
1. How to Report
Send your report to security@userelay.sh. Include:
- The affected product and component (for example the dashboard, the API, the CLI, the agent or the Agent Edition) and its version.
- Steps to reproduce, and a proof of concept if you have one.
- The impact you observed or expect.
- How we can reach you for follow-up.
2. What to Expect
- We acknowledge your report within 3 business days.
- We triage it and tell you our assessment within 7 days.
- We keep you updated until it is fixed, and credit you in the advisory if you wish.
- We follow coordinated disclosure: we ask you to wait up to 90 days from your report, or until a fix is available, before publishing details. We will agree on a shorter timeline if the issue is being actively exploited.
3. Scope
In scope: userelay.sh and its subdomains operated by Relay, the Relay API and dashboard, the relay CLI, the Relay agent, and the Agent Edition.
Out of scope:
- Denial-of-service and volumetric testing.
- Social engineering of Relay staff or customers, and physical attacks.
- Accessing, changing or deleting data that is not yours, including other customers' data.
- Vulnerabilities in third-party services we use, which should be reported to that vendor.
- Findings without a demonstrated security impact, such as missing headers on pages without sensitive content.
4. Testing Rules
Test only against accounts you own or have permission to use. Stop and report as soon as you can show the issue, without retaining other people's data. Do not run automated scanners at a volume that degrades the Service.