Security

If you find a security problem on infrarabbit.com, please tell us. This page says how.

How to report

Email security@infrarabbit.com. Include:

• what you found and where (URL, API path or MCP tool);
• the steps to reproduce it;
• what you think the impact is;
• how to reach you, if you want an answer.

Please do not include real personal data. Describe it instead.

Mail is sorted automatically. A person reads security reports. We do not promise a reply time. We read every report and fix what is real.

What is in scope

• infrarabbit.com and its sub-paths: /prices, /crawlers, /v1, /mcp, /api.
• status.infrarabbit.com.
• Our crawler, InfraRabbitBot: for example, a way to make it fetch internal addresses (server-side request forgery).

What is out of scope

• Services run by others: Hetzner, Cloudflare, Migadu, the merchant of record. Report problems in those to the owner.
• Denial of service, load tests and automated scanning at volume. The rate limits are on purpose.
• Social engineering of anyone, and physical attacks.
• Missing headers or settings with no demonstrated impact.
• Wrong or outdated data. That is a correction, not a vulnerability: see the FAQ.
• Reports from automated scanners with no proof of impact.

Please

• Test only with your own accounts, keys and data.
• Stop when you reach someone else's data and tell us.
• Give us time to fix the problem before you publish it.
• Do not change or delete data.

Our side

We do not take legal action against people who follow this policy in good faith. We do not run a bounty programme. We do not offer payment for reports. We credit reporters who ask for it, once the problem is fixed.

security.txt

Served at /.well-known/security.txt as plain text (RFC 9116). The platform session generates the file. Fields:

Contact: mailto:security@infrarabbit.com
Expires: 2027-10-30T00:00:00.000Z
Preferred-Languages: en, nl
Policy: https://infrarabbit.com/security
Canonical: https://infrarabbit.com/.well-known/security.txt

Rules for the file:

• Contact and Expires are required. Expires is at most one year after the launch (Sat 31 Oct 2026). ir-watch alerts before it expires (delta-1, platform item 10), so the date is renewed once a year.
• Policy points to this page.
• Canonical is the URL the file is served from.
• No Encryption field: we do not publish a PGP key. Add one only if a key exists.
• No Acknowledgments field: we keep no hall-of-fame page.
• No Hiring field.