Bug bounty

Security vulnerabilities in the platform are reported to security@nationalcompute.com and rewarded by the severity of the impact the report demonstrates: Low $100, Medium $250, High $1,000, Critical $10,000 or more. The definitions on this page decide a report's tier. Where the page is silent we decide, then amend the page; a report is rated by the page as it read when the report arrived. Research that follows the rules of engagement is authorized (safe harbor).

Scope

Surface	In scope
nationalcompute.com, console.nationalcompute.com: the console, its signed-out public pages, the REST API under /api, the MCP server under /mcp, the documents center	Yes
auth.nationalcompute.com: sign-in, account creation, OAuth	Yes
docs.nationalcompute.com, access.nationalcompute.com: documentation and onboarding	The hosts, not the words on them
workspaces.nationalcompute.com: Marshall workspaces	Your own workspace
Clusters, nodes, login nodes and VM grants your organization holds	Your own tenancy (node-level testing)
Staff-only pages and hosts of the platform	Their sign-in gate only: past it, stop and report
Other organizations' accounts, clusters, workspaces and data	Never
Services the platform buys from others: cloud hosting, email delivery, web analytics, payment processing	No; report those to their owners

Capacity reaches you through a site endpoint and port named by your cluster credentials. Connect only to that host and port: every other port at that address belongs to another tenant.

Rules of engagement

• Test only what you own. Accounts you created, your organization, and the clusters and workspaces it holds. Create accounts on the sign-in page; if your address lands on the waitlist, email security@nationalcompute.com with the address and it is admitted as a test account. At most 5 test accounts, named in your report.
• Stop at proof. The moment a test reads another party's data or acts as another party, stop. Keep the minimum evidence: an identifier, a count, at most one record with its contents redacted. Do not store it elsewhere, pass it on, or go back for more, and destroy it when the report is acknowledged.
• Leave nothing behind. No persistence, no lateral movement, no change to anything you do not own, no markers.
• No volume. No denial of service, no load testing, no volume testing of sign-in or the market. Automated tooling stays under 5 requests per second per host. A rate-limit measurement is a burst of at most 100 requests against your own account.
• No people, no premises. No social engineering or phishing of staff or tenants, no physical access.
• Details before money. A report that withholds reproduction steps pending payment is not triaged.

Public Marshall, the anonymous feed on the signed-out console, and published checkpoints are public by design; reading them is not a finding, and Public Marshall's per-visitor allowance is a courtesy limit, not a security control.

Node-level testing

On capacity your organization holds — a Kubernetes cluster, a Slurm cluster, a VM grant, a Marshall workspace — you may attempt to leave the tenancy: container or VM escape, reaching the node from a workspace, reaching another tenancy's nodes or network. You pay for the capacity at the market's terms like any tenant. Do not touch firmware or out-of-band controllers, do not disable or alter the platform's on-node management software (getting past it is the test; damaging it is not), and persist nothing beyond the test. Inside your own tenancy you already hold cluster-admin or root: what those rights allow is not a finding. A node allocated to you that carries a previous tenant's data is a Critical finding (sanitization): stop reading at proof and report.

Severity tiers

A report is rated by the impact it demonstrates against the platform as deployed, not by the class of bug or the score a scanner assigns. A chain is rated once, by its end state. One root cause is one report, however many endpoints show it. Platform credentials found outside the platform are rated by what they open, once we confirm they were live.

Two terms carry the definitions:

• Private data of an organization: its credentials (cluster kubeconfigs and certificates, SSH access, org API tokens, OAuth, session and ServiceAccount tokens); the contents of its Marshall sessions, workspace files and shells; its unpublished checkpoints and uploaded files; its billing records, invoices, credit balance and payment details; its workload definitions, logs and outputs.
• Identity data: whether an account exists, its email address and name, an organization's name, and who is a member of what.

Critical: $10,000 minimum

Class	Definition
Account or organization takeover without interaction	Signing in as, or acting as, another user or organization while the victim does nothing beyond ordinary use. Authentication bypass; forging, predicting or reusing a session, sign-in link, confirmation link or token; account creation that lands you in an existing organization; a flaw in OAuth or MCP sign-in. Ordinary use includes being signed in and browsing the console; it excludes opening an attacker's link or page.
Cross-organization access to private data	Reading, changing or destroying the private data of an organization you are not a member of, even one record.
Control-plane code execution	Running code or commands of your choosing on the platform's own services: the console and API, the identity provider, the workspace plane, the software that controls a site's nodes.
Cross-tenant escape	From capacity or a workspace your organization holds, reaching another tenancy's nodes, pods, processes, storage or network traffic; or another tenant's data on a node allocated to you.
Billing and credit integrity	Creating or inflating credits, obtaining capacity or model usage the ledger does not charge for, or changing another organization's charges, reservations or balance. Credits the platform's own sign-up rules grant to accounts you created are the rules working, not a finding.
Platform-staff privilege	Obtaining a session, token or role the platform treats as platform staff. Reaching one staff-only page or dashboard without that privilege is rated by what it shows (High or Medium below).

Critical pays $10,000 at minimum; impact beyond the definition (a single flaw that yields several classes, or every organization at once) earns more, at our discretion, with no stated ceiling.

Not Critical: a takeover that needs the victim to open a link or page (High); exposure limited to identity data (Medium, High in bulk); a staff-only page reached without staff privilege (rated by what it shows); code execution inside your own tenancy; anything that starts from an already compromised staff account or device, or from intercepted TLS; denial of service (ineligible).

High: $1,000

Class	Definition
Account takeover with interaction	Taking over another user's account after one action by the victim (opening a link or a page) and nothing further: stored XSS that takes a session, an OAuth redirect hijack, a login CSRF that binds the victim's account to yours.
Escalation within your organization	Acting with a right your credential does not hold: an action that refuses API tokens performed with one, a member performing an action reserved to another role or to a console session, a credential that works after the platform says it is dead (a revoked token, an expired sign-in link, a session after sign-out).
Bulk identity exposure	Listing identity data across organizations: an endpoint that enumerates accounts, members or organizations you are not in, or an oracle fast enough to walk.
Isolation gap, authentication holding	From a tenancy, reaching a platform management or host service that is not meant to be reachable, while that service's own authentication holds.
Server-side request forgery	A platform service made to reach internal addresses on your behalf. If the response carries control-plane credentials or private data, the Critical rules apply.
Stored injection	Stored XSS or content injection in a surface other organizations or staff see, without a demonstrated takeover.
Hostname takeover	Control of a hostname under a company domain through a dangling record.
CSRF on a consequential action	Forcing a signed-in victim to mint a token, add or remove a member, change the data-sharing tier or billing settings, or destroy a preserved volume.

Medium: $250

Class	Definition
Single identity exposure	Identity data of one account or organization, or an existence oracle (does this address have an account, is this person in that organization).
Reflected or DOM XSS	Script execution in the victim's browser that needs interaction, without a demonstrated takeover.
CSRF on a lesser action	A forced state change not in the High list.
Open redirect in sign-in	A redirect in the sign-in or OAuth flow to a host you control.
Internal information past a gate	A staff-only page or host reached past its gate, showing platform operational information (metrics, configuration, internal structure) and no private data.
Feasible brute force	An authentication secret with no rate limit and a keyspace the measured rate exhausts in under 30 days. Under 24 hours is the takeover it enables (Critical).

Low: $100

Class	Definition
Open redirect	A redirect to a host you control, outside the sign-in flow.
Internal details	Software versions, stack traces, internal paths, or configuration carrying no secret.
Infeasible brute force	A missing rate limit on a secret the measured rate does not exhaust in 30 days.
Public information past a gate	A staff-only page reached past its gate, showing nothing beyond what is public.
Minor misconfiguration	A cookie flag or header whose absence you show has an effect on a specific page, short of any tier above.
Mail spoofing	A message that reaches an inbox as a company domain, demonstrated.

Downgrades

A report drops one tier, to Low at the lowest, for each of: the victim must do more than one thing (several steps, a non-default setting, pasting something into the console); the attack starts from a position you would not have (another member of the victim's organization cooperating, a compromised device or browser, physical access). A control the report does not get past ends the report at that control: it is rated by what it reaches, not by what it would reach.

Ineligible

No reward, and the first two are prohibited:

• Denial of service, resource exhaustion, or rate-limit reports made by volume.
• Social engineering, phishing, physical attacks.
• Reports without steps that reproduce. Best-practice advice: a header absent with no effect, SPF, DKIM or DMARC without a demonstrated spoof, TLS cipher preferences, a version banner with a CVE and no working exploit against our deployment.
• Self-XSS, and XSS that needs the victim to paste.
• Clickjacking: every console page refuses framing; a report of a page that does not has to show a state change.
• Anything inside your own tenancy that the rights you hold allow.
• Marshall behavior: jailbreaks, harmful or wrong model output, system prompt disclosure, and prompt injection that yields none of the impacts above. Prompt injection that does (crossing an organization boundary, exfiltrating data, exceeding the member's own rights) is rated by that impact.
• The words on the documentation site.

Known and accepted

These are documented behavior, not findings:

• Node-local disks are not encrypted at rest (Trust Center).
• An org API token's recorded scopes narrow nothing: every token acts for the whole organization (Authentication).
• The email sign-in link signs in whoever opens it within 24 hours of sending; a second factor is asked for only on accounts that enrolled one (Sign in).
• Sessions last 30 days from an email link and 7 days from Google or a password (Sign in).

A report of an issue we already know internally receives no reward; the reply says "known since" with the date, and the researcher is credited with their consent.

Reporting

Email security@nationalcompute.com, in English, one root cause per message, with:

• the surface and endpoint, and the time of the test in UTC;
• the test accounts and organizations you used;
• steps that reproduce, with the requests and responses;
• the impact and the tier you claim, by this page's definitions;
• for access to data that is not yours, the identifier and the count, never the contents.

Attachments are fine; executables and archives containing them are discarded unread. Reports go by plain email; if something is too sensitive for email, say so in the first message and another channel is arranged. Replies come from the same address. The same contact is published as /.well-known/security.txt (RFC 9116) on nationalcompute.com, console.nationalcompute.com and this host.

Step	Within
Acknowledgement	3 business days of the report
Severity decision, with the reasoning by this page	10 business days of the acknowledgement
Fix shipped, Critical	7 days of the decision (target)
Fix shipped, other tiers	60 days of the decision (target)
Payment started	The fix shipping, or 60 days after the decision, whichever is first
Payment complete	30 days after it starts, tax paperwork permitting

Business days are Monday to Friday, US Pacific time, excluding US federal holidays. The first report of a root cause, by the time the mail arrived, is the one rewarded; later reports of the same cause are told so. One appeal per report, with new evidence or a reading of this page the decision got wrong, is answered within 10 business days; that answer is final.

Rewards and eligibility

Tier	Reward
Critical	$10,000 minimum, more at our discretion
High	$1,000
Medium	$250
Low	$100

Rewards are paid in US dollars by bank transfer or PayPal. Instead of cash you may take platform credits at 1.5 times the amount, applied to your organization's balance (Billing). Before any payment you provide tax paperwork (a W-9 for US persons, a W-8BEN otherwise) and must be someone we can lawfully pay: not a sanctioned person or in a jurisdiction we cannot pay. Current staff and contractors of the platform and its operators, anyone who was one in the past 12 months, and members of their households are ineligible. A researcher under 18 names a parent or guardian to receive payment. One reward per root cause; a report that holds several root causes is several reports.

Coordinated disclosure

You may publish a finding 90 days after your report, or once we confirm the fix shipped, whichever is earlier, after telling us at least 7 days ahead. We may ask for more time, with the reason; an extension is by agreement. Until then the details stay with you and us: no public write-up, no sharing with third parties, no sale. Publishing earlier forfeits the reward and the safe harbor below. With your consent we credit you on this page.

Safe harbor

Research that follows this page is authorized. We will not pursue or support legal action against you for it, including under computer misuse and anti-circumvention laws, and if a third party starts action over research done under this page we will make it known that it was authorized. The authorization ends where the rules of engagement do: it never covers other tenants' data or services the platform buys from others. If you break a rule by mistake, say so in the report; a prompt, honest account of a mistake is treated as good faith.