Security and vulnerability reporting

If you have found a vulnerability in Atmos, tell us at support@atmoslab.dev. Security reports go to the front of the queue, ahead of everything else in the inbox.

Reporting a vulnerability

Send us enough to reproduce it:

• What you did, in the order you did it.
• What you expected and what happened instead.
• The affected surface and version. For the CLI, the output of atmos --version.
• Any proof of concept you have, as an attachment rather than a link to a third party.

Report first and give us a chance to fix it before you publish. We will not pursue legal action over research that follows this page in good faith, that stops at the first sign of access to data that is not yours, and that does not degrade the service for anyone else. There is no paid bounty program today, and we will credit you in the release notes if you want that.

In scope

• atmoslab.dev, docs.atmoslab.dev, app.atmoslab.dev and the ingest endpoint.
• The atmos command line scanner and the editor extension.
• Every endpoint the scanner calls.
• Machine sign-in and the workspace token model.

Out of scope

• Denial of service, volumetric testing and anything that degrades the service.
• Social engineering of our people, our customers or our vendors.
• Scanner output with no working proof of concept, missing hardening headers with no exploit, and findings in third-party services we do not control.
• A rule that misses a vulnerability. That is a detection gap, not a vulnerability in Atmos. Send those to the same address and we will treat them as engine work.

How Atmos is built to fail safely

• Scans run on your machines. The platform never clones your repositories, and source lines leave your machine only when you pass --snippets. See what leaves your machine and the Privacy Policy.
• Revocable credentials. atmos login signs a machine in only after you approve the request in your browser. Every machine sign-in and workspace token can be revoked at any time, and the editor extension stores no credential of its own.

Machine-readable contact

The same contact is published at /.well-known/security.txt, which names this page as its policy.