Security Standard/Vulnerability Disclosure/v1.0 (October 2026)

Vulnerability Disclosure & Bug Bounty

We value the contributions of independent security researchers. If you discover a vulnerability or cryptographic weakness in Cockpit, we encourage responsible disclosure and reward critical findings.

Security Contact: security@cockpit.run•Response Window: < 24 Hours

Safe Harbor Guarantee

We consider research conducted under this policy to be authorized. Cockpit and Intellaris Private Limited will not pursue civil or criminal action against researchers who discover and report issues in good faith, avoid privacy violations, do not destroy data, and do not disrupt platform availability.

1. Scope of the Program

Our disclosure and bounty program covers security vulnerabilities across our core products and infrastructure:

In-Scope Targets

Cockpit Web Application (cockpit.run, app.cockpit.run)
Client-Side Encryption Vault & WebCrypto implementation
Blind WebSocket SSH & PTY relay daemon architecture
Isolated Node Telemetry Agent
Account authentication, token handling, and session management APIs

Out-of-Scope Activities

Volumetric Denial of Service (DDoS) against our relays or servers
Social engineering or phishing targeting Cockpit employees or contractors
Physical attacks against data centers or partner hosting facilities
Targeting third-party Linux servers connected by other users (testing must only occur on servers you own)
Missing security headers (SPF, DMARC, CSP) that do not result in a demonstrable exploit

2. Areas of High Interest

We prioritize vulnerabilities that challenge our cryptographic guarantees or isolate boundaries:

Cryptographic Leakage: Flaws that could allow server or relay operators to recover private keys, passwords, or plaintext SSH traffic without the client-side master secret.
Relay Session Cross-Talk: Remote code execution (RCE) on packet relays, memory leaks between concurrent user tunnels, or channel multiplexing flaws.
Agent Sandbox Escapes: Privilege escalation or breakout from the isolated Cockpit telemetry agent beyond its scoped container or process limits.
Authentication Bypass: Exploits enabling unauthorized access to another user's registered server list or session credentials.

3. Bounty Rewards

Bounties are awarded based on severity evaluated using CVSS v3.1 and real-world impact on our non-custodial architecture:

Critical Severity

$1,000 – $5,000+

Remote code execution, private key exfiltration, or cryptographic break of client-side encryption.

High Severity

$500 – $1,000

Authentication bypass, session hijacking, or direct server metadata disclosure.

Medium Severity

$150 – $500

Stored XSS with demonstrated impact, relay rate-limit starvation, or agent permission leaks.

Low Severity

Cockpit Swag / Hall of Fame

Low-risk bugs, defense-in-depth improvements, and minor configuration oversights.

* Rewards are delivered via crypto (USDC/USDT) or direct wire transfer depending on jurisdiction.

4. Submission Guidelines

To report a vulnerability, please email our engineering security team:

# Send encrypted or plaintext submissions to:

security@cockpit.run

# Please include:

• Clear description of the vulnerability and attack scenario

• Step-by-step reproduction instructions or proof-of-concept (PoC)

• Expected vs actual behavior

• Suggested mitigation or patch, if available

You may optionally encrypt your report using our security team's PGP public key available upon request or published at /.well-known/security.txt.

5. Our Commitment to Researchers

When you submit a report under our disclosure program, we commit to the following service levels:

Initial Acknowledgment: Within 24 hours of submission.
Triage & Validation: Within 3 business days, including CVSS scoring.
Remediation: Fast-tracked priority deployment according to severity.
Public Credit: Recognition in our Security Hall of Fame (or anonymity if preferred).