Security and disclosure

If you think you have found a security problem in one of our images or on this site, write to security@secopscentral.com. It is the only address for security reports. Questions and general feedback go to hello@secopscentral.com.

What to send

• The image name and version, and the region and architecture if you know them.
• What you saw, and the steps to see it again.
• Your assessment of the impact, if you have one.

Please do not include real customer data, and do not post details in public before we have answered.

What to expect

• We acknowledge your report within three business days.
• We tell you whether we can reproduce it, and keep you informed until it is resolved.
• When a fix needs a new image, we publish it and say so in the release notes. We credit you if you wish.
• We ask for reasonable time to fix a problem before you disclose it, and we agree a date with you.

Scope

In scope are the images we publish and this site.

• A problem in software we include but do not write is best reported to its authors as well. Tell us too, so we can ship a fixed image.
• Out of scope: denial-of-service testing, social engineering, physical attacks, and testing against anyone’s systems but your own. Launch our images in your own account to test them.

Good-faith research

If you follow this policy, stay within scope, avoid harming other people’s data or services, and give us time to respond, we will treat your research as authorised and will not pursue action against you.

What we publish

We list what each image adds in plain terms, not how it is configured. We do not discuss configuration or detection details in reports and replies beyond what is needed to fix a problem.