Responsible disclosure
Report a vulnerability
Email security reports to security@unrent.dev. Please do not open public issues or post details before the problem is fixed.
What to include
- What you found and where: the host, the page or API route, or the agent version (
unrent status) - Steps to reproduce it, and what an attacker could do with it
- How we can reach you, and whether you would like to be credited
In scope
unrent.dev,app.unrent.dev,api.unrent.dev,mcp.unrent.devandget.unrent.dev- The agent (
unrentd,unrent-exec, theunrentCLI) and its installer - Anything that lets one organisation see or change another’s data, run a job without a valid signature, or skip a passkey approval
Apps that customers deploy on unrent.page addresses belong to those customers. To report abuse by one of them, use the abuse form.
While you test
- Use your own account and servers; never access or change other people’s data
- Do not degrade the service for others (no load or denial-of-service testing)
- Give us reasonable time to fix a problem before you publish it
Coming A full disclosure policy with safe-harbour terms, published with the legal pages.
Machine-readable contact: /.well-known/security.txt (RFC 9116).