Security
Report a vulnerability
Report a potential security issue affecting Easel.
Report suspected vulnerabilities privately to security@easel.sh so Easel can
investigate before anything is disclosed. Don't post them in community
channels. Easel acknowledges reports promptly and coordinates disclosure with
you.
If you think your own account is compromised, see Workspace security.
What to include
- What the issue is and which product or endpoint it affects
- Steps to reproduce, with proof-of-concept requests or code
- The security impact and any preconditions
- Relevant workspace, project, deployment, or request IDs
- Whether customer data may be affected
- How to reach you
Don't include customer secrets or unrelated personal data.
Research guidelines
- Only test systems you're authorized to assess.
- Don't run denial-of-service tests against production.
- Don't access or exfiltrate customer data.
- Don't use social engineering against Easel staff or customers.
- Give Easel reasonable time to investigate before you disclose publicly.