Security & Responsible Disclosure

1. HOW TO REPORT

Email security@virtmcu.com with:

• a description of the vulnerability and its potential impact;
• clear, reproducible steps or a minimal proof-of-concept;
• the affected endpoint/component and any relevant request IDs or timestamps.

We aim to acknowledge reports within 3 business days and to keep you informed as we investigate.

2. SCOPE

In scope: the Site (virtmcu.com), the hosted API and MCP endpoints (api.virtmcu.com), the cloud-compile endpoint, authentication and API-key handling, tenant isolation and sandbox boundaries, and the billing/account surfaces.

Out of scope (examples): third-party services we use (report those to the respective provider — e.g. Google Cloud, Firebase, Stripe); volumetric denial-of-service; social engineering of our staff or customers; physical attacks; automated scanner output without a demonstrated, exploitable impact; and best-practice suggestions without a concrete vulnerability.

3. RULES OF ENGAGEMENT (GOOD-FAITH RESEARCH)

To qualify for the safe harbor in Section 4, you must:

• act in good faith to avoid privacy violations, data destruction, and service disruption;
• test only against your own accounts, tokens, and sessions, and only with data you own — do not access, modify, or exfiltrate another customer's data, firmware, or sessions;
• not perform denial-of-service, load/stress testing, or resource-exhaustion attacks against the Service;
• stop as soon as you have demonstrated a vulnerability, and not pivot, escalate, or maintain persistence beyond what is needed to demonstrate it;
• not use the vulnerability to access data beyond the minimum necessary to demonstrate it;
• give us a reasonable time to remediate — at least 90 days, or as mutually agreed — before any public disclosure, and coordinate any disclosure with us; and
• comply with all applicable laws.

This is an explicit, limited exception to the Acceptable Use Policy's prohibition on security testing against the Service (AUP §3.4).

4. SAFE HARBOR

If you make a good-faith effort to comply with this policy during your security research, we will:

• consider your research authorized by us under the Acceptable Use Policy, and, to the extent it is within our power to grant, authorized access for purposes of the Computer Fraud and Abuse Act (and equivalent laws) and any applicable anti-circumvention law;
• not pursue or support civil legal action against you, and not report you to law enforcement, for accidental, good-faith violations of this policy; and
• work with you to understand and resolve the issue promptly.

We can only waive our own civil claims and authorize access we control; this safe harbor cannot and does not waive or immunize you from third-party claims or from any government criminal prosecution (for example, under the CFAA or DMCA §1201), which are not ours to grant. If legal action is initiated by a third party against you for activity conducted consistent with this policy, we will make our authorization known. This safe harbor does not apply to activity that is malicious, that harms our customers or their data, or that violates the law. If you are unsure whether a specific action is authorized, ask us first at security@virtmcu.com before proceeding.

5. RECOGNITION

We currently offer public recognition (with your permission) for valid, in-scope reports, but do not offer monetary rewards (no bug bounty) at this time.

6. OUR SECURITY PRACTICES (SUMMARY)

For transparency, the Service is designed with: TLS/HTTPS everywhere; API keys stored only as SHA-256 hashes; per-session tenant isolation (one ephemeral, single-use environment per session); network-isolated, hardened compile sandboxing; WAF/DDoS protection at the edge; and least-privilege service accounts with secrets in Secret Manager. See the Privacy Policy for data-handling and retention, and the Sub-processors list.

7. CONTACT

Security reports: security@virtmcu.com. Non-security support: support@virtmcu.com.