Security

Reporting a vulnerability#

Write to santanarobainaa@gmail.com with the subject line "Security". The same address is published at /.well-known/security.txt.

A useful report contains:

1. What the issue is and what an attacker could achieve with it.
2. Exact steps to reproduce it, including URLs and any account you used.
3. Anything that helps — a request, a screenshot, a short recording.

Please report in English or Spanish, and give us a reasonable chance to fix the issue before making it public.

What to expect#

Nautacloud is run by one person as a free service, so these are honest targets rather than contractual commitments. You will always get a real answer from a human.

Safe harbour#

If you research in good faith and follow this policy, we will not pursue legal action against you, and we will treat your research as authorised.

Good faith means:

• You only test against your own account and your own sites.
• You do not access, modify or delete data belonging to anyone else — and if you reach someone else's data by accident, you stop, and you tell us.
• You do not degrade the service: no denial of service, no load testing, no spam.
• You do not use social engineering or physical intrusion.
• You give us reasonable time to fix the issue before disclosing it.

In scope#

• The application and API at nautacloud.net.
• The site-serving path on *.nautacloud.net — in particular anything that lets one site affect another, or affect the dashboard.
• Authentication, session handling and the command-line access tokens.
• Authorisation: anything that lets one account read or change another account's sites or data.
• The deploy pipeline: archive handling, path traversal, resource exhaustion.
• The nauta command-line tool.

Out of scope#

• Content published by other users. Report that as abuse instead — it is a policy matter, not a vulnerability.
• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers or TLS configuration preferences with no working attack behind them.
• Denial of service, volumetric testing, or anything that degrades the service for others.
• Social engineering of the operator or of users.
• Vulnerabilities in AWS itself — report those to AWS security.
• Absence of rate limiting on endpoints where no impact can be shown.

There is no bug bounty#

Nautacloud is free and has no revenue, so we cannot pay for reports. We will not pretend otherwise. What we can offer is a fast, honest response, credit on this page if you want it, and a genuine fix.

Securing your own account#

• Turn on two-factor authentication in your dashboard. It is the single biggest improvement you can make.
• Treat command-line tokens like passwords. They publish to your sites. Never commit one to a repository.
• Revoke tokens you no longer use — the dashboard lists every active one.
• Remember that everything you publish is public. Never put an API key, a password or a private document in a site directory.