Skip to main content

Security policy

Report issues privately. Review our current controls plainly.

This page explains how to report vulnerabilities, what data Skylos Cloud may process, and which compliance claims Skylos does not make today.

Report a vulnerability on GitHubOr email founder@skylos.devsecurity.txtTrust Center

Local-first scanning

The open-source scanner can be used locally or in CI. Skylos Cloud receives scan data only when a user or workflow uploads a report, triggers a cloud action, or uses the public scan endpoint.

Cloud upload data

Uploaded reports may include findings, severity, rule IDs, file paths, line numbers, snippets, upload attribution, scan metadata, and optional provenance or defense evidence.

Credential handling

Project tokens are stored as hashes. Dashboard users with rotate:keys permission can issue secondary project tokens and revoke stale ones.

Managed infrastructure

Skylos Cloud runs on Vercel and Supabase, and hosted scans run in temporary Vercel Sandbox machines. GitHub, Lemon Squeezy, OpenAI, Anthropic (on your own key), Resend (email), Cloudflare, Slack, and Discord are used only for the related configured or user-triggered workflows. The subprocessor list on the Trust Center gives each one's data and location.

Storage limits

Ordinary scan history is capped per project: 10 scans on Free, 500 on Workspace, and 10,000 on Enterprise. The oldest scans are pruned as new reports are accepted. Owners can also set an age limit (30 days at the shortest) and delete a whole workspace after a 7-day grace period. Explicit Scanner Proof audit receipts are hard-capped and retained until their project or workspace is deleted.

Compliance status

Skylos has no SOC 2, ISO 27001, or CSA STAR certification, and no audit is under way. The Trust Center lists every control and every gap.

Coordinated disclosure scope

  • Skylos public website and authenticated Cloud application
  • Skylos API routes, dashboard routes, report upload flows, and public scan endpoint
  • Authentication, authorization, billing, project token, and GitHub OIDC paths

Out of scope

  • Social engineering, spam, physical attacks, or denial-of-service testing against production
  • Reports that require access to another customer's account, data, repository, or credentials
  • Automated high-volume scanning without prior written approval
  • Findings already documented on the public roadmap or trust page as not yet implemented

How reports are handled

Skylos is small, so the right disclosure process is direct and low-friction. The goal is fast private reproduction without creating risk for other customers.

Report privately through GitHub private vulnerability reporting (the button above), with enough detail to reproduce the issue. If you can't use GitHub, email founder@skylos.dev instead.
Use the minimum data and minimum account access necessary to demonstrate the issue.
Do not access, modify, delete, or disclose another customer's data.
We aim to acknowledge security reports within 2 business days and provide an initial triage update within 5 business days.
We do not operate a paid bug bounty program today.

Buyer security review

For customer security reviews, use the Trust Center. It includes a code-vetted control checklist, current provider list, data handling notes, and explicit SOC 2, ISO 27001, and CSA STAR status.