Private reporting only. Please send suspected vulnerabilities to gus@gusdigitalsolutions.com. Do not include secrets, production credentials, or customer data in the first message, and do not file a public issue.
MVP boundaries
- One customer or trusted organization per runtime VM.
- The node agent initiates the authenticated connection; enrollment must not leave an unrestricted root credential in the control plane.
- Every operation has a versioned action type, validated arguments, tenant and node identity, issue and expiry timestamps, and an idempotency key.
- Application secrets are encrypted when central storage is necessary, never logged, and never exposed through broad report proxies.
- Destructive actions require explicit confirmation and produce audit events.
Actions excluded from customer-facing MVP APIs
Arbitrary shell text, Docker option passthrough, plugin installation, raw root commands, container entry, generic run commands, and browser terminal access.
Release evidence required
- Exact supported runtime tag, source hash, package inventory, and third-party notices.
- Fresh supported-OS enrollment and revoke/rotate tests.
- Authorization, cross-tenant isolation, replay, expiry, injection, and secret-redaction tests.
- Canary update failure proving customer rollout stops.
- Encrypted backup plus restore into a fresh target, with integrity readback.
- Incident, deletion, employee access, and break-glass runbooks.
Third-party runtime
The planned runtime integration uses supported interfaces from the open-source Dokku project. CloudRivet is independent and is not affiliated with or endorsed by Dokku or its maintainers. This website repository does not vendor Dokku source.