Overalls.

An AI-first developer platform that you own.

 Guide Self-host
Design Architecture
Source GitHub · MIT Appearance

Security

Overalls runs other people's code on other people's hardware, so we take reports of security problems seriously. This is our vulnerability disclosure policy: what's in scope, how to report, and what you can expect from us.

Report to
GitHub private security advisory
Reward
Public thanks on the hall of fame and credit in the advisory. There is no cash bounty.
Machine-readable
/.well-known/security.txt

In scope

  • The Overalls source code at github.com/ghuntley/overalls : Marshall, Lilly, Porsche, Audi, Brady, Enrico, Galileo, Ziggy, the overalls CLI, the browser extension, the NixOS modules, the bootstrap tool and the guest images.
  • Anything that lets one tenant reach another: escaping a guest, crossing the guest network isolation, reading another account's machines, terminals or usage, or reading secrets that are supposed to stay at the edge.
  • This website, overalls.dev.

Out of scope

  • Other people's deployments. There is no hosted Overalls. Every deployment belongs to whoever runs it, and only they can authorise testing it. If you find a problem in someone's deployment that comes from Overalls itself, reproduce it on your own and report it here.
  • Third-party services, including GitHub, Ghost and ghuntley.com, Cachix, and AI model providers. Report those to the service.
  • Denial of service, load or volumetric testing, spam, social engineering and physical attacks.
  • Scanner output without a working proof of concept.

How to report

  1. Open a private security advisory on the Overalls repository. Please don't open a public issue or pull request.
  2. Include the commit or release you tested, how it was deployed, step-by-step reproduction, and what an attacker gains.
  3. Keep any data you came across private, and don't include other people's data in the report.

Rules of engagement

  • Test against a deployment you own and run.
  • Don't access, change or delete data that isn't yours. Stop and report as soon as you've shown the problem.
  • Don't degrade a service for other people.
  • Give us a reasonable time to fix the problem before you talk about it publicly. We aim to agree a disclosure date with you, normally within 90 days of the report.

What you can expect

  • We'll confirm we've received your report and keep you updated as we investigate and fix it.
  • We'll publish a GitHub security advisory for confirmed problems, request a CVE where one applies, and credit you unless you'd rather stay anonymous.
  • With your permission, we'll add you to the hall of fame.

Safe harbour

If you research and report in good faith and follow this policy, we consider your research authorised. We won't pursue or support legal action against you for it, and if someone else does, we'll make it clear you acted under this policy. This covers only what we control: the Overalls project and this website. We can't authorise testing of deployments or services that belong to anyone else.