Security & Vulnerability Disclosure
How we handle vulnerability reports, deployment security, and data handling for ChaosEngine. We publish this in the open because we ask offensive-security tooling of our users — the least we can do is hold ourselves to the same standard.
Reporting a vulnerability
If you believe you've found a security vulnerability in ChaosEngine or on this site, report it to core@secuenz.com. See our machine-readable security.txt for the current contact and disclosure timeline.
Please include:
- A description of the vulnerability and its impact
- Steps to reproduce, or a proof of concept
- The affected component, endpoint, or workflow node
Testing authorization
Do not run active scans, exploitation attempts, or load testing against production Secuenz infrastructure without prior written authorization from core@secuenz.com. ChaosEngine itself is built to orchestrate offensive-security tooling against targets you are authorized to test — see our Acceptable Use Policy for what that means when using the product.
Deployment & data handling
This section describes our current approach honestly rather than claiming certifications we don't hold.
- Certifications: We do not currently hold SOC 2, ISO 27001, or similar third-party certifications. We will update this page if that changes.
- Credential storage: Details on how workflow credentials and secrets are stored and scoped are being finalized ahead of general availability.
- Tenant isolation: Multi-organization isolation model is documented in the docs as it stabilizes.
- Worker security: Workflow execution runs through workers; hardening details will be published alongside general availability.
- Audit logging: Organizations and role-based access control are part of the platform; specifics on audit log retention are in progress.