# Report a vulnerability

> Email security reports to [security@unrent.dev](mailto:security@unrent.dev). Please do not open public issues or post details before the problem is fixed.

URL: https://unrent.dev/security/disclosure/

## What to include

- What you found and where: the host, the page or API route, or the agent version (`unrent status`)
- Steps to reproduce it, and what an attacker could do with it
- How we can reach you, and whether you would like to be credited

## In scope

- `unrent.dev`, `app.unrent.dev`, `api.unrent.dev`, `mcp.unrent.dev` and `get.unrent.dev`
- The agent (`unrentd`, `unrent-exec`, the `unrent` CLI) and its installer
- Anything that lets one organisation see or change another’s data, run a job without a valid signature, or skip a passkey approval

Apps that customers deploy on `unrent.page` addresses belong to those customers. To report abuse by one of them, use [the abuse form](https://unrent.dev/abuse/).

## While you test

- Use your own account and servers; never access or change other people’s data
- Do not degrade the service for others (no load or denial-of-service testing)
- Give us reasonable time to fix a problem before you publish it

> **Coming:** A full disclosure policy with safe-harbour terms, published with the legal pages.

Machine-readable contact: [/.well-known/security.txt](https://unrent.dev/.well-known/security.txt) (RFC 9116).