Report a vulnerability
Report a vulnerability to us at security@penv.cloud. One of our staff acknowledges it within 2 business days. What to send and what not to.
security@penv.cloudSend your report to us at this one address. We run no bounty program or platform.
Report contents
Finding: one sentence, plus the affected address or page.
Reproduction: the exact request or steps. A curl command with the value redacted is ideal.
Impact: what an attacker gains. Cross-workspace reads and a missing security header are triaged differently.
Test window: start and end time with timezone, and the workspace or account you tested from. We match your report to audit entries with it.
Exclusions
Never send us a live credential, yours or one you obtained. Rotate it, then describe its shape rather than its value. A working credential in a report is a second incident.
| Do not send | Send instead |
|---|---|
| Another workspace's values | A statement that they are readable and how. Stop reading. |
| A full database dump or memory dump | The two lines that prove the finding. |
Audit trail of testing
Every read lands an audit entry with the credential, the address, the time, and the source IP, visible to the affected workspace. Your test window matches your report to those entries.
Test against your own workspace: reading one you were not invited to is visible and attributed, and a report does not excuse it. See the audit log.