Security Disclosure Policy

Last updated: June 18, 2026

We take security seriously and welcome reports from researchers and users who help us keep Boardwalk safe. This page explains how to report a vulnerability, what we promise in return, and what is in scope.

1. How to report

Email security@boardwalk.sh. If you need to encrypt your report, ask for our PGP key in your first message and we'll send it. We also publish a machine-readable /.well-known/security.txt file pointing here.

2. What to include

• A clear description of the issue and the affected surface (URL, API endpoint, package name and version).
• Steps to reproduce: exact requests, payloads, and any preconditions.
• Proof-of-concept material: screenshots, request/response captures, or a short script.
• Your assessment of impact and any suggested remediation.
• Whether you used an account, organization, or workflow under your own control to reproduce the issue.

3. Safe-harbor commitment

For research conducted in good faith and consistent with this policy, we will:

• Not pursue or support legal action against you for the research.
• Treat your activity as authorized under the Computer Fraud and Abuse Act, equivalent state and foreign computer-misuse laws, and the anti-circumvention provisions of the DMCA.
• Treat the research as exempt from the "don't probe the Service" clause of our Acceptable Use Policy, to the extent of the research permitted here.
• Work with you to understand the issue quickly and credit you publicly if you wish.

Safe-harbor only covers research that follows this policy. It does not authorize work that violates any other person's rights or that breaks laws unrelated to computer access (for example, unauthorized disclosure of someone else's information).

4. In scope

• boardwalk.sh and the subdomains we operate, including the web app (app.boardwalk.sh) and API (api.boardwalk.sh).
• The Boardwalk REST and MCP APIs.
• The runtime that executes workflow runs, including tenant isolation, the credential broker, secret redaction, and egress controls.
• The official @boardwalk-labs/cli and @boardwalk-labs/workflow packages on npm, and the open-source runtime engine and runner.
• Authentication and login-session handling via Clerk as wired into our Service.

5. Out of scope

• Third-party services and infrastructure not operated by us (AWS, PlanetScale, Clerk, Stripe, Vercel, OpenRouter, Tavily). Report those to the relevant vendor.
• Issues that require a victim to install attacker-controlled malware on their own device, or to perform multiple unrealistic steps.
• Denial-of-service attacks, traffic flooding, and load testing.
• Social engineering of our employees, contractors, or vendors.
• Physical attacks on offices or data centers.
• Reports based solely on missing security headers, weak SSL configurations, or other low-impact configuration findings without demonstrated impact.
• Findings against staging or experimental hosts that are clearly marked as such.
• Use of any account or organization other than your own without the owner's authorization.

6. Rules of engagement

• Use accounts, organizations, and workflows that you own or have explicit permission to test.
• Stop and report as soon as you confirm a vulnerability. Don't pivot deeper than necessary.
• Don't access, modify, or delete data that doesn't belong to you. If you accidentally encounter another tenant's data, stop, don't download or share it, and tell us.
• Don't run brute-force, high-volume automated scanning, or other tests that disrupt the Service or other users.
• Don't publicly disclose the issue until we've had a reasonable opportunity to investigate and remediate.

7. Response targets

• Acknowledgment: within 3 business days of receipt.
• Triage and severity assessment: within 10 business days.
• Remediation timeline:we'll share an expected fix window once we've assessed severity. Critical issues are prioritized for urgent remediation; lower severities are scheduled based on risk and impact.
• Coordinated disclosure: we work with you on disclosure timing, with a default coordinated-disclosure window of 90 days from acknowledgment for unfixed issues.

8. Recognition

We may recognize qualifying researchers publicly after a fix ships, with their consent. We don't operate a paid bug-bounty at this time. If that changes, we'll update this page.

9. Contact

Questions about this policy or to coordinate a disclosure: security@boardwalk.sh.