Report it privately, we fix it fast

Email support@provencloud.io with [SECURITY] at the start of the subject line. That prefix routes the message ahead of everything else in the inbox.

Tell us which image and version (or which page of this site), how to reproduce the issue, and what you believe the impact is. Proof-of-concept code, a request/response capture or a screenshot all help; a CVSS estimate is welcome but not required.

Please report privately rather than in a public issue tracker, blog post or social media, and give us the chance to fix it before disclosing. We will not ask you to sign anything to do so.

• Acknowledgement and triage the same business day the report arrives (Monday to Friday, 10:00–19:00 IST). Reports arriving outside those hours are triaged the next business day.
• A named engineer owns the report from triage to fix and keeps you updated as the status changes — at minimum when we confirm the issue, when a fix is published and when we consider it closed.
• Critical CVEs in shipped software get a published revision within 72 hours of the upstream fix. Lower-severity issues ride the scheduled monthly roll-up, and each revision's release notes say what changed.
• Credit, if you want it. We name reporters in the release notes of the fixing revision unless you ask us not to.

In scope: every image in the catalog — the software it ships, its default configuration, its first-boot credential handling and its build process — and this website, including its forms and API routes.

Out of scope: AWS and Azure infrastructure and their marketplaces (report those to the cloud provider), software you install on top of an image, denial-of-service testing, social engineering of our staff, and findings that need physical access to a machine.

Research conducted in good faith, within the scope above, that avoids privacy violations, data destruction and service disruption, and that is reported to us privately, is authorised. We will not pursue legal action against researchers who follow this page, and we will say so to any third party who asks.

The same four guarantees hold for every image, and each product page states them in its security posture:

• Official sources only. Every component comes from its vendor's own repository or release, never from a mirror or a rebuilt binary.
• No baked credentials. No password, key or token ships inside an image; credentials are generated on your instance at first boot.
• Locked down before capture. Build tooling, shell history and temporary files are removed before the image is captured, and the result is documented on the product page.
• Nothing to install. No agent, no control plane and no call home — the image is an image ID you run with your own tooling.

Questions about any of this, or about a specific image's posture, are ordinary support questions — see the support page.