Responsible security disclosure

Prepare a security report

Use the security contact options to describe a suspected vulnerability. The contact page identifies available delivery channels; preparing or copying a report alone does not send it.

Include the affected Renderly page or documented API route, a concise description, minimal reproduction steps, expected and actual behavior, and the potential impact. Use your own account and remove secrets or other people’s personal data from screenshots and examples.

Scope

This policy concerns demonstrable vulnerabilities in Renderly-operated application features and documented API behavior. Examples include access to another account’s records, permission bypasses, unauthorized credit or payment changes, exposed secrets and exploitable code execution.

External websites, unrelated services and other organizations’ systems are outside this scope. A link from Renderly does not authorize testing its destination. A suspicious result or policy concern can be reported through the content reporting options instead.

Rules for responsible investigation

• Use accounts and data you own or have explicit permission to test.
• Limit testing to the smallest safe demonstration. Stop when you have enough evidence to describe the issue.
• Do not access, copy, alter or delete another person’s information. If unexpected access occurs, stop and report the location without collecting more data.
• Do not conduct denial-of-service attacks, high-volume scanning, brute force, social engineering or attempts to compromise personnel.
• Do not spend another account’s credits, make real unauthorized purchases, leave persistent access or disrupt ongoing jobs.
• Keep vulnerability details private while a coordinated disclosure can be arranged. Any authorization for broader testing must be explicit.

Review and coordinated disclosure

A useful report explains a plausible security impact, rather than only listing a scanner warning or a general best-practice recommendation. Additional information may be needed to reproduce and assess the problem.

Follow the rules above and act in good faith. This policy provides a reporting framework; it does not expand your authorization to access protected systems or override applicable law. Any wider testing agreement, public attribution or financial reward must be expressly agreed.

Response and remediation depend on the report and its severity. No fixed response time or public bug bounty is promised.