1. Responsible Disclosure & Safe Harbor Commitment
At dAutomata, the security of our deterministic coworker platform and our customers' VPC boundaries is paramount. We actively encourage responsible vulnerability research and coordinate closely with ethical hackers, independent researchers, and academic institutions.
Safe Harbor Protection: If you conduct vulnerability research in good faith and in compliance with this policy, dAutomata pledges that:
- We consider your research authorized under relevant computer crime laws (including the CFAA and DMCA).
- We will not initiate legal action or pursue criminal complaints against you.
- We will work collaboratively with you to validate, triage, and remediate the issue promptly.
2. Reporting Procedures & PGP Encryption
Please send detailed vulnerability reports to our dedicated security engineering team at:
security@dautomata.com
When submitting reports involving sensitive reproduction payloads, please encrypt your email using our official PGP Public Key:
3. Program Scope & Target Systems
In-Scope Targets:
*.dautomata.com(Control plane API, Web console, Ingress webhooks).- dAutomata In-VPC Worker Daemon binaries and Docker/Helm deployment controllers.
- Deterministic Google CEL policy evaluation interceptors.
- Authentication & SAML 2.0 / SCIM endpoints.
Out-of-Scope Targets:
- Volumetric denial-of-service (DDoS/DoS) attacks against platform infrastructure.
- Social engineering, phishing, or physical attacks targeting dAutomata employees or facilities.
- Third-party services integrated by customers (e.g. AWS, Slack, Stripe, Datadog APIs).
- Attacks requiring physical access to an unlocked, authenticated customer terminal.
4. Bug Bounty Reward Matrix
We reward eligible, qualifying vulnerability reports based on CVSS v3.1 severity scores and real-world exploitability:
| Severity Tier | CVSS v3.1 Score | Example Vulnerability | Reward Range |
|---|---|---|---|
| Critical | 9.0 – 10.0 | Remote Code Execution (RCE) inside worker micro-VM, cross-tenant context leakage, CEL policy bypass allowing unauthorized API mutations. | $2,500 – $10,000+ |
| High | 7.0 – 8.9 | Privilege escalation within tenant workspace, authentication bypass on webhook ingress, sensitive credential extraction. | $1,000 – $2,500 |
| Medium | 4.0 – 6.9 | Stored Cross-Site Scripting (XSS) affecting tenant administrators, CSRF on state-changing operations, insecure direct object reference (IDOR). | $250 – $1,000 |
| Low | 0.1 – 3.9 | Informational disclosures, missing defense-in-depth headers without proven exploitability. | Swag + Hall of Fame |
5. Response Time Commitments (SLAs)
Our dedicated security incident response team adheres to strict communication SLAs:
- Initial Acknowledgment: Within 24 business hours of receipt.
- Triage & Reproduction: Within 72 business hours with severity assignment.
- Critical Remediation Target: Hotfix deployment within 48 hours of verification.
- Bounty Payment: Issued within 7 business days post-verification via wire transfer or cryptocurrency.
6. Enterprise Technical Security Controls
For enterprise customers evaluating our security posture, dAutomata enforces the following technical baselines across our engineering stack:
- Transport Security: Strict TLS 1.3 enforced on all external endpoints with HSTS preloaded (`max-age=31536000; includeSubDomains; preload`).
- Micro-VM Sandboxing: Worker node tool execution takes place in isolated Google gVisor micro-VMs with restricted system calls and zero access to host kernel namespaces.
- Cryptographic Verification: All state machine transitions are signed using node-specific Ed25519 keypairs stored in FIPS 140-2 Level 3 HSM enclaves.
- Zero Shared State: Worker memory spaces are allocated per-task and zeroized immediately post-execution.