Security and vulnerability reporting

If you have found a vulnerability in Atmos, tell us at support@atmoslab.dev. Security reports go to the front of the queue, ahead of everything else in the inbox.

Reporting a vulnerability

Send us enough to reproduce it:

• What you did, in the order you did it.
• What you expected and what happened instead.
• The affected surface and version. For the CLI, the output of atmos --version.
• Any proof of concept you have, as an attachment rather than a link to a third party.

Report first and give us a chance to fix it before you publish. We will not pursue legal action over research that follows this page in good faith, that stops at the first sign of access to data that is not yours, and that does not degrade the service for anyone else. There is no paid bounty program today, and we will credit you in the release notes if you want that.

In scope

• atmoslab.dev, docs.atmoslab.dev, app.atmoslab.dev and the ingest endpoint.
• The atmos command line scanner and the editor extension.
• The scan upload path, the license endpoint and the workspace token model.

Out of scope

• Denial of service, volumetric testing and anything that degrades the service.
• Social engineering of our people, our customers or our vendors.
• Scanner output with no working proof of concept, missing hardening headers with no exploit, and findings in third-party services we do not control.
• A rule that misses a vulnerability. That is a detection gap, not a vulnerability in Atmos. Send those to the same address and we will treat them as engine work.

How Atmos is built to fail safely

• Scans run on your machines. The platform never clones your repositories. What a scan uploads is the findings report: rule ids, repository identity, branch, file paths, line numbers and one-way hashes of committer emails. Source lines are omitted unless you pass --snippets yourself. See what leaves your machine and the Privacy Policy.
• One credential, revocable. The workspace token is shown once, can carry an expiry, and can be revoked at any time. The editor extension keeps it in the operating system keychain and passes it to the CLI through the environment, never on a command line.
• No card data. Payments run through hosted Stripe Checkout, so card details never reach Atmos systems.
• No trackers. This site loads no analytics and no third-party scripts, and its content security policy blocks them at the browser.

Machine-readable contact

The same contact is published at /.well-known/security.txt, which names this page as its policy.