Security at Breakwater
Help us protect the systems built to protect others.
If you believe you have found a vulnerability affecting a Breakwater-operated public service, please report it privately and include enough evidence for us to reproduce it safely.
Email a security report →What to report
Reports should concern a potential security weakness in a Breakwater-operated public website, application, API, or service. Customer-managed deployments, customer data, and third-party services are not implicitly in scope.
If scope is unclear, contact us before testing further.
What to include
- The affected URL, component, or service.
- A concise description of the suspected vulnerability and its potential impact.
- Reproduction steps, relevant request and response details, and supporting screenshots or logs.
- The date and time of testing and any assumptions required to reproduce the behavior.
- A safe way to contact you for follow-up.
Testing boundaries
Please minimize access to data and systems, stop when you have enough evidence to demonstrate the issue, and preserve confidentiality while we investigate.
- Do not access, modify, retain, or disclose data that does not belong to you.
- Do not use denial-of-service, destructive, persistence, social-engineering, or physical-security techniques.
- Do not degrade service availability or interfere with customers, users, or third parties.
- Do not publicly disclose an unresolved report without first attempting private coordination.
This guidance is not a bug-bounty offer or blanket authorization to test any system.
Our process
We will review reports submitted in good faith, validate the affected scope, and communicate next steps as appropriate. Resolution timing depends on severity, reproducibility, product ownership, and deployment context; this page does not promise a fixed response or remediation deadline.