Spacelift

Vulnerability Disclosure Program

At Spacelift, your security is our first and foremost priority. We run this program to earn and maintain this trust and to keep Spacelift secure. If you believe you've found a security vulnerability, we want to hear from you!

Submit report

Easy rules

We run our Vulnerability Disclosure Program on Intigriti. To submit a report, open our program page and follow the submission steps. Include affected URLs or endpoints, clear reproduction steps, and any supporting material so our team can validate and remediate the issue quickly.

This is a disclosure program: it does not offer monetary bounties, but we recognise and credit researchers who report valid issues in good faith.

Program rules

In scope

  • Scope
    app.spacelift.dev, *.app.spacelift.dev, spacelift.dev
  • Header
    X-BugBounty with your email address
  • Type
    web-application

Out of scope

  • Assets and domains not listed on the Intigriti program page
  • Findings from automated scanners without a demonstrated, real-world impact
  • Denial-of-service (DoS/DDoS) and volumetric or resource-exhaustion attacks
  • Social engineering, phishing, or physical attacks against Spacelift staff or facilities
  • Reports of missing best-practice headers or configurations with no proven exploit
  • Vulnerabilities in third-party services or dependencies we do not control Testing

Testing guidelines

  • Test only against assets that are in scope
  • Provide clear, reproducible steps and supporting proof-of-concept material
  • Report each issue as soon as you discover it and give us reasonable time to remediate
  • Use only your own test accounts and data when investigating an issue
  • Keep any information about discovered vulnerabilities confidential until we confirm a fix

Please avoid

  • Accessing, modifying, or deleting data that does not belong to you
  • Degrading, disrupting, or interrupting the availability of our services
  • Running intrusive automated scans that generate high volumes of traffic
  • Exfiltrating data, or maintaining access after a vulnerability is confirmed
  • Publicly disclosing a vulnerability before we have resolved it

Safe harbor

We will not pursue or support legal action against researchers who discover and report vulnerabilities in good faith and in accordance with these rules. If you make a good faith effort to comply with this program during your research, we will consider your actions authorized, and we will work with you to understand and resolve the issue quickly.

The definitive scope, submission form, and program terms are maintained on our Intigriti program page. For anything you’re unsure about, reach out to security@spacelift.io.

© 2026 Spacelift, Inc. All rights reserved