Security disclosure

We want to hear about security problems before anyone else does.

Last updated 2026-10-21

Scope#

• aurix.run (console, docs and the /v1 control-plane API), the voice cells (cell-*.aurix.run, ws-cell-*.aurix.run), the rooms demo, the node agent and installer, the SDKs and the open-source engine.
• Out of scope: denial of service, social engineering, physical attacks, third-party services (Paddle, Hetzner, GitHub), findings from automated scanners without a working proof.

Rules#

• Test only against your own organisations and projects; never access other customers' data — if you stumble on it, stop and report.
• No data exfiltration beyond the minimum proof; no persistence; no spam to our users.
• Give us 90 days before public disclosure; we will keep you informed and credit you if you wish.

How to report#

E-mail [email protected] (also listed in /.well-known/security.txt). We acknowledge within 2 business days, triage within 7, and fix critical issues as fast as humanly possible.

Safe harbour#

Good-faith research under these rules will not lead to legal action from us, and we consider it authorised under applicable anti-hacking laws to the extent we can grant that.