Security at CloudSurf
If you have found a security problem in CloudSurf, thank you — we want to hear about it.
How to report a vulnerability
Email security@cloudsurf.com. Please include:
- what you found and where (the address, the screen or the app and its version);
- the steps that show it, as simply as you can;
- what someone could do with it;
- how you would like to be credited, if at all.
Please send one problem per email, keep the details between you and us until it is fixed, and do not include anyone else's personal data — a screenshot with it blurred is plenty.
What happens next: we acknowledge your report within [acknowledgement window — Brady], keep you told as we work on it, and tell you when it is fixed. Our machine-readable contact is at /.well-known/security.txt.
Safe harbour
We will not take legal action against you, or ask anyone else to, for research that:
- is done in good faith to find and report a vulnerability;
- uses only your own accounts and workspaces, or accounts whose owners have agreed;
- stops as soon as you reach data that is not yours — you do not read, keep, change or delete it;
- does not degrade the service for other people (no denial of service, no spam, no load testing);
- is reported to us promptly and kept private until we have fixed it.
If you are unsure whether something is covered, ask us first at security@cloudsurf.com.
Scope
In scope: cloudsurf.com, app.cloudsurf.com, the CloudSurf apps for iPhone, Mac and Android, the CloudSurf CLI and the MCP connection.
Out of scope: social engineering of our team or our customers, physical attacks, attacks on the services we use (report those to the provider), findings that need a rooted or jailbroken device, missing best-practice headers with no shown impact, and automated scan output with no working proof.
Rewards: we do not run a paid bug bounty today. We are glad to credit you publicly if you would like.
We do not publish a PGP key; please email us in plain text and we will arrange a safer channel if a report needs one.
How CloudSurf protects you
- Encryption. Traffic to CloudSurf is encrypted in transit, and browsers are told to use only secure connections. Your data is stored on encrypted volumes, and the credentials CloudSurf keeps for you — the GitHub and Gmail connections you make — are sealed with a separate key, so a copy of the database alone does not reveal them.
- A second factor. You can protect your account with an authenticator app, and administrators of a workspace must. Sensitive actions ask you to confirm it is you again.
- Strong passwords and sign-in limits. Passwords must be long, known-breached passwords are refused, and repeated failed sign-ins are slowed down.
- An activity log. Workspace administrators can see who did what and when — sign-ins, sharing, keys, billing and security changes — and you can see your own.
- Keys that expire. API keys for agents and tools expire after 90 days unless you choose otherwise, and you are told before one stops working.
- Every change checked. Each change to CloudSurf is scanned for known-vulnerable dependencies and for secrets before it ships.
Effective: [date — published at landing].