From e90ad711f10699b6cc30111f968b858d2a3b44fb Mon Sep 17 00:00:00 2001 From: Matt Braun Date: Fri, 23 Oct 2026 17:42:09 -0500 Subject: [PATCH] Security page: say how a vulnerability report is handled This page is the Policy URL in fly.io's security.txt, and vendor security programs read it to see whether reports get handled. It only said where to email. Now it says what to include, what not to do, a 3 business day acknowledgment, no bounty, no public credit, and asks for a fix window before publication. --- security/index.mdx | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/security/index.mdx b/security/index.mdx index c31cb4a81f..2e74c2d041 100644 --- a/security/index.mdx +++ b/security/index.mdx @@ -43,6 +43,12 @@ _Fly.io corporate security, compliance, and shared responsibility._ --- -## Talk to the security team +## Reporting a vulnerability -If you have a security question, concern, or believe you’ve found a vulnerability in any part of our infrastructure, please contact us. You can reach us at [**security@fly.io**](mailto:security@fly.io), and we can provide you with a Signal number if needed to convey sensitive information. +If you believe you have found a vulnerability in any part of Fly.io, email [**security@fly.io**](mailto:security@fly.io). If you need an encrypted channel, ask and we will set one up. Our machine-readable contact file is at [fly.io/.well-known/security.txt](https://fly.io/.well-known/security.txt). + +What to include: the affected component or hostname, steps to reproduce, and what you were able to access. Do not access, modify, or exfiltrate customer data beyond what is needed to demonstrate the issue, and do not test against other customers' applications. + +What to expect from us: we acknowledge reports within 3 business days and tell you when the issue is fixed. We do not run a bug bounty program and do not publish reporter acknowledgments. We ask that you give us a reasonable window to fix the issue before publishing details, and we will tell you if we need more time. + +For security questions that are not vulnerability reports, the same address works.