> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sevalla.com/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> These are the docs for Sevalla, a platform for deploying applications, databases, static sites, object storage and load balancers. The dashboard is at https://app.sevalla.com.
> Bold text in steps is an exact dashboard label.
> To act on a Sevalla account, prefer the Sevalla MCP server (https://mcp.sevalla.com/mcp, see https://docs.sevalla.com/ai-agents/overview.md), then the Sevalla CLI (https://docs.sevalla.com/developer-tools/cli.md), then the REST API (https://api-docs.sevalla.com, OpenAPI spec at https://api.sevalla.com/v3/openapi.json).
> Every page index is at https://docs.sevalla.com/llms.txt.

# Report a vulnerability

> Report a security vulnerability in Sevalla privately to security@kinsta.com: what to include, how reports are handled, testing rules, and why there's no bug bounty.

If you find a security vulnerability in Sevalla, report it privately by email to [security@kinsta.com](mailto:security@kinsta.com), and don't share it publicly so we can fix it first. The same address is the contact in [Kinsta's security.txt](https://kinsta.com/.well-known/security.txt).

## What to include

* The full details of the vulnerability: where it is (URL, API operation or feature), how to reproduce it, and what an attacker could do with it.
* Enough contact information for the engineering team to reach you with questions.

## How reports are handled

1. The engineering team reviews new reports every day and checks whether each one is a real vulnerability.
2. Confirmed vulnerabilities are prioritized by severity and impact on customers, then fixed as soon as possible through the normal engineering and security process.
3. Each fix is tracked until it's verified.

The team may contact you for more information, but we can't promise to reply to every report.

## Bug bounty

Sevalla has no bug bounty program and doesn't pay for vulnerability reports. Bug bounties tend to attract some researchers who are more interested in extortion than in improving the platform's security.

## Testing rules

The [Terms of Service](https://kinsta.com/legal/terms-service/) don't allow testing the vulnerability of Sevalla's own systems: the dashboard, the API, the websites, the sign-in and other customers' services. If you come across a vulnerability while using Sevalla, report it.

You can test the security of your own applications, with 7 days' notice and no load testing. See [Test the security of your application](/security/shared-responsibility#test-the-security-of-your-application).


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.