- Operator
- Kohsuke Egami
- Contact
- kohsuke@ato.run
- Last updated
Security Policy
This page describes security practices and vulnerability reporting for ato.run.
We use layered controls such as verification checks, moderation workflows, and abuse monitoring. These controls reduce risk but do not guarantee complete prevention.
1. Reporting Vulnerabilities
If you discover a potential vulnerability, please report it with reproduction steps, impact details, and affected URLs or package IDs.
Send reports to kohsuke@ato.run. Our contact details are also published at security.txt. Reports in English or Japanese are welcome.
2. Scope
In scope: ato.run, api.ato.run, app execution origins under ato.run, and the Ato CLI and runtime published by us.
Out of scope: software published by other users (report it to its publisher, or to us under the Acceptable Use Policy if it is malicious), denial-of-service testing, social engineering, and physical attacks.
3. Responsible Disclosure
We ask reporters to avoid public disclosure until mitigation is available, avoid accessing unnecessary data, and avoid actions that harm users or service availability. Use only accounts and data you own or have permission to test.
We will not pursue legal action against good-faith research that follows this policy.
4. Incident Response
We acknowledge reports, triage them, apply containment measures, and may disable affected listings or accounts while remediation is in progress. We will keep reporters informed of progress and notify affected users and authorities where required by law.
5. User Safety Recommendations
Review requested permissions carefully, run software with least privilege, and verify publisher reputation and update history before use.
6. Security Contact
Security reports: kohsuke@ato.run or Contact us