Skip to main content
If you find a security vulnerability in Sevalla, report it privately by email to security@kinsta.com, and don’t share it publicly so we can fix it first. The same address is the contact in Kinsta’s security.txt.

​
What to include

  • The full details of the vulnerability: where it is (URL, API operation or feature), how to reproduce it, and what an attacker could do with it.
  • Enough contact information for the engineering team to reach you with questions.

​
How reports are handled

  1. The engineering team reviews new reports every day and checks whether each one is a real vulnerability.
  2. Confirmed vulnerabilities are prioritized by severity and impact on customers, then fixed as soon as possible through the normal engineering and security process.
  3. Each fix is tracked until it’s verified.
The team may contact you for more information, but we can’t promise to reply to every report.

​
Bug bounty

Sevalla has no bug bounty program and doesn’t pay for vulnerability reports. Bug bounties tend to attract some researchers who are more interested in extortion than in improving the platform’s security.

​
Testing rules

The Terms of Service don’t allow testing the vulnerability of Sevalla’s own systems: the dashboard, the API, the websites, the sign-in and other customers’ services. If you come across a vulnerability while using Sevalla, report it. You can test the security of your own applications, with 7 days’ notice and no load testing. See Test the security of your application.