Reporting a vulnerability

If you have found a security issue in train.cloud or in Border Collie, we want to hear about it before anyone else does.

How to report

Email arijit.das@selfsupervised.de with enough detail to reproduce the issue — the endpoint or command, what you sent, and what came back. If you have a proof of concept, include it.

Please do not open a public issue for a security report, and please do not test against another tenant's data. If you need an account to demonstrate something, ask and we will set one up.

Acknowledgement

Within 3 working days.

Assessment

Within 10 working days you will get our view of severity and whether we are treating it as a fix, a mitigation, or accepted risk — with reasons.

Credit

Named in the release notes if you want it, anonymous if you don't.

We are a small team and do not currently run a paid bounty programme. We would rather say that plainly than let you assume otherwise.

What the platform enforces today

These are the controls that exist in the shipped system, not a roadmap.

Tenant isolation in the database

Every application table carries ENABLE ROW LEVEL SECURITY and FORCE ROW LEVEL SECURITY, so the policies apply to the table owner as well. Queries run under a scoped role with the tenant identifier set per connection; a query that forgets to filter by tenant returns nothing rather than returning another tenant's rows.

File storage

Uploads are written under a server-derived per-tenant key prefix with SSE-KMS using that tenant's customer-managed key. The prefix is never supplied by the client — there is no request shape that lets one tenant name another tenant's path.

Third-party credentials

Connected GitHub and OpenAI credentials are stored encrypted with AES-256-GCM envelope encryption. The database holds ciphertext only. A token is never returned to the browser, never placed in a redirect URL or a cookie, and never logged.

Authentication

Sign-in goes through Amazon Cognito using the authorization-code flow with PKCE. The application never links directly to the identity provider: a local route mints the state, nonce and code challenge first. Session cookies are httpOnly and sealed, and every authenticated route re-verifies the token server-side rather than trusting the presence of a cookie.

Scope

In scope: train.cloud and its API, and the Border Collie source and released binaries.

Out of scope: findings that require a compromised device or browser extension, reports generated by a scanner with no demonstrated impact, missing headers with no exploit path, and social engineering of our team or our vendors.

Border Collie

Border Collie captures agent traces on your machine and redacts locally before anything is uploaded. It runs fully offline; the network path to train.cloud is something you opt into, not the default. Its SECURITY.md ships in the repository and points at this same address.