Vulnerability Disclosure Policy

Introduction

At Roadrunner, we take the security of our platform and our customers' data seriously. We value the contributions of the security research community and welcome the responsible disclosure of potential vulnerabilities.

This policy describes how to report security issues, what systems are in scope, and how we work with researchers to remediate valid findings.

1. Reporting a Vulnerability

If you believe you have identified a security vulnerability, please report it to: security@roadrunner.ai

Please include sufficient detail to allow us to understand and reproduce the issue.

2. Program Guidelines

2.1 Scope & Safe Harbor

We welcome good-faith security research on all internet-facing assets operated by Roadrunner.

In-scope assets include, but are not limited to:

• Public web applications
• Public APIs
• Backend services supporting customer-facing functionality
• Infrastructure directly managed by Roadrunner

We provide safe harbor for good-faith security research conducted in accordance with this policy. We will not pursue legal action under the Computer Fraud and Abuse Act (CFAA) or the Digital Millennium Copyright Act (DMCA) for research that:

• Is conducted responsibly
• Avoids privacy violations and service disruption
• Is reported promptly and privately

Responsible disclosure is permitted, provided it does not expose or compromise customer data.

2.2 Out of Scope

The following activities are not permitted under this policy:

• Denial-of-Service (DoS/DDoS) or traffic flooding attacks
• Social engineering of employees, contractors, or customers
• Physical security testing
• Automated vulnerability scanning without manual validation
• Brute-force attacks against authentication systems
• Issues in third-party services or dependencies not directly controlled by Roadrunner

2.3 What We Need From You

To help us efficiently assess and remediate issues, please include:

• A clear description of the vulnerability
• The affected product, service, endpoint, or URL
• Step-by-step reproduction instructions
• An explanation of potential impact and severity
• Proof-of-concept (where possible), avoiding harm
• Contact information for follow-up questions

2.4 Response Expectations

We prioritize reports based on severity, exploitability, and potential customer impact.

Due to report volume, we may not respond to submissions that:

• Do not follow this disclosure policy
• Contain unvalidated or speculative findings
• Describe low-impact issues commonly flagged by automated scanners
• Are duplicates of previously reported vulnerabilities
• Rely primarily on social engineering or brute force techniques

2.5 Good-Faith Research Guidelines

When conducting security research, please:

• Make every effort to avoid privacy violations or service disruption
• Only test against accounts or data you own or have explicit permission to use
• Do not access, modify, or delete customer data
• Immediately stop testing and report the issue if customer data is encountered
• Avoid actions that could degrade the reliability or availability of our services

2.6 Recognition

At this time, Roadrunner does not operate a paid bug bounty program.

We nonetheless appreciate the efforts of security researchers and, with permission, may acknowledge individuals who responsibly disclose valid security issues.