Security and vulnerability disclosure

Draft for legal review. This document describes how rent-gpu.app works today, but it has not yet been reviewed by counsel and may change before launch.

How to report

Email security@rent-gpu.app with what you found, the steps to reproduce it, and the impact you expect. We acknowledge within 3 business days and keep you updated until it is fixed.

In scope

• The website and API at rent-gpu.app and api.rent-gpu.app
• The agent gateway and relay, including isolation between instances
• The host agent and the rgpu CLI

Applications that renters run behind *.run.rent-gpu.app belong to those renters and are out of scope.

Rules

• Test only with accounts and instances you own. Never access or change other people’s data.
• No denial of service, spam, social engineering, or physical attacks.
• Give us reasonable time to fix an issue before you disclose it publicly.

Safe harbor

If you follow these rules in good faith, we will not pursue legal action against you for your research. We do not run a paid bug bounty yet.