Last updated 6 October 2026

Rutken is a security product, and we hold our own software to the same standard. If you believe you have found a vulnerability in Rutken, our website, our API, or the plugin registry, we want to hear from you and we will work with you to fix it.

How to report

Email security@rutken.com. Our machine-readable contact is published at /.well-known/security.txt. Please include enough detail for us to reproduce the issue: affected endpoint or component, steps, and any proof-of-concept. If a report contains sensitive data, say so and we will arrange a secure channel.

Scope

• rutken.com, www.rutken.com, and api.rutken.com
• The Rutken CLI, GUI, and launcher
• The plugin registry and its signing/verification chain

Out of scope

• Denial-of-service, volumetric, or resource-exhaustion attacks
• Social engineering, phishing, or physical attacks against us or our staff
• Vulnerabilities in third-party services we use (report those to the provider)
• Reports from automated scanners without a demonstrated, exploitable impact

Safe harbor

We will not pursue or support legal action against researchers who act in good faith and in accordance with this policy: who make a genuine effort to avoid privacy violations, data destruction, and service degradation, who only interact with accounts they own or have explicit permission to test, and who give us a reasonable opportunity to remediate before any public disclosure.

What to expect

• We aim to acknowledge your report within three business days.
• We will keep you updated as we validate and work on a fix.
• We practice coordinated disclosure and will credit you, with your permission, once an issue is resolved.

We do not currently run a paid bug-bounty program, but we genuinely appreciate and acknowledge every good-faith report.

For anything that is not a vulnerability, for example misuse of Rutken or our services, please contact abuse@rutken.com.