Security
Vulnerability disclosure
The studio does not run a public bug bounty and there is no public issue tracker. Reports are read by the engineering leads and, where a partner is affected, that partner is notified through the account they already hold. The machine-readable policy lives at /.well-known/security.txt.
Scope
In scope. The three public gateways — this API hub, the cloud rendering portal and the build repository — including their authentication flows and the transport configuration behind them.
Out of scope. Denial-of-service and load testing of any kind, social engineering of studio staff, physical access, and findings produced solely by automated scanners without a reproducible impact.
Safe harbour. Research carried out within this scope, without data exfiltration, service disruption or disclosure of third-party information, is treated as authorised testing. Public disclosure before a fix is available is treated as a breach of this policy.
Report a vulnerability
Your report has been queued. Security findings are reviewed manually by the Vrynthia engineering leads, and report details stay inside the studio and the affected partner.
Machine-readable policy: /.well-known/security.txt