What to include
- The affected version or commit
- Steps to reproduce (or a proof of concept)
- What you think the impact is — data exposure, auth bypass, RCE, etc.
Real reports get acknowledged as soon as possible, with updates as a fix is worked on. There's no bug bounty program at this time.
In scope
- Authentication/authorization bugs — session handling, org/project access checks
- Row-Level-Security (RLS) bypass — the tenant-isolation model the whole product depends on
- SSRF in the crawler — the SSRF guard exists specifically to prevent this; a real bypass is a real finding
- Secrets handling — anything that could leak API keys, tokens, or the database connection string
- SQL, command, or template injection in any real code path
Generally out of scope
- Issues that only reproduce on a self-hosted instance deliberately misconfigured against the documented setup (e.g. running the database connection as a superuser despite the docs explicitly warning against it)
- Missing rate limiting on non-authentication endpoints
- Third-party API keys or credentials the operator chose to configure — DataForSEO, AI providers, Stripe, and OAuth providers are the operator's own accounts
Supported versions
RosterSEO doesn't yet have tagged releases — security fixes land on main. Once versioned releases exist, this section will list which are still receiving fixes.
RosterSEO