root-me.cloud: Program guidelines

Welcome, and thank you for taking the time to look at the security of root-me.cloud.

We build and run the services at root-me.cloud ourselves, and we know that no amount of internal review replaces a fresh pair of eyes. If you have found a way to break, bypass or abuse one of our systems, we would genuinely like to hear about it.

This is a vulnerability disclosure program: there is no cash reward, but every valid report earns reputation and, with your permission, a public thank-you on our Thanks page. Read the policy below before you start — it tells you what is in scope, how to test safely, and what to expect from us once you submit.

Scope at a glance

We want reports about anything that could put our users, their data or our infrastructure at risk on the assets listed on the Scope tab. When in doubt, send it — we would rather read a report that turns out to be low impact than miss something that matters.

In scope, broadly:

• Authentication and session handling flaws
• Access-control and authorization problems (IDOR, privilege escalation, tenant isolation)
• Injection of any kind (SQL, command, template, XML), SSRF and deserialization issues
• Cross-site scripting, request forgery and other client-side vulnerabilities
• Sensitive-data exposure, misconfiguration and secrets left where they should not be
• Business-logic flaws that let someone do something they should not be able to do

The exact systems you may test, and the ones you may not, are on the Scope tab. Only assets marked in scope are authorized targets.

Rules of engagement

• Test only accounts you own. Create your own accounts to test with. Never access, modify or delete data that is not yours.
• Prove it, do not exploit it. Once you have confirmed a vulnerability, stop. A single screenshot or request/response pair is enough — do not pivot, escalate or pull more data than is needed to demonstrate the issue.
• If you reach real personal data, stop immediately, do not save or share it, and tell us in the report. We will not hold responsible disclosure against you.
• No denial of service, no load or stress testing, no automated scanning that degrades the service for others, and no spam, phishing, social engineering or physical attacks against our staff, offices or users.
• Use your own test data for any destructive action, and clean up afterwards where you can.

Out of scope and ineligible findings

Reports that only point at the items on the Scope exclusions table, or that describe a theoretical weakness with no demonstrated security impact, will be closed as Informative or Not applicable. That is not a judgement of your effort — it just keeps the queue focused on issues we can act on.

How to write a report we can act on quickly

A good report gets triaged faster. Please include:

1. A clear title and the affected asset.
2. The vulnerability type (pick the closest weakness) and, if you can, a CVSS vector.
3. Step-by-step reproduction, starting from a signed-out state where possible.
4. A short, concrete description of the impact — what an attacker could actually achieve.
5. Supporting material: a request/response pair, a minimal proof-of-concept, or a screenshot.

What you can expect from us

• First response within 3 days — a human acknowledging your report, not an auto-reply.
• Triage within 5 business days — we validate the issue and set a severity.
• Resolution target of 90 days — most fixes land much sooner; complex ones we will keep you posted on.
• Honest communication, and a retest once we believe the issue is fixed.

Recognition

root-me.cloud does not pay cash bounties. Instead, valid reports earn reputation, and resolved reports can be credited to you publicly on our Thanks page. If you would rather stay anonymous, just say so in the report and we will keep your name off it.

Coordinated disclosure

We support coordinated disclosure. After a report is resolved, either side can request disclosure, and the report becomes public once both agree. We will work with you on timing and on how much detail is published. Please do not disclose a vulnerability publicly before we have had a reasonable chance to fix it.

Safe harbor

We will not pursue or support legal action against researchers who follow this policy in good faith. See the full statement on the Safe harbor tab.

Contact

Submit findings through this program. For anything that does not fit a report — a question about scope, or a sensitive issue you would rather raise privately first — use the contact address on our platform settings.