Runware Vulnerability Disclosure

generated: '2026-07-21'
method: searched
probe: true
source: https://runware.ai/security-disclosure
policy: [https://runware.ai/security-disclosure]
program_type: responsible-disclosure
bug_bounty: false
contact: [security@runware.ai]
response_target: Acknowledge valid, in-scope reports within 5 business days.
in_scope:
- Unauthorised access to data
- Authentication or authorisation bypass
- Cross-tenant data exposure
- Privilege escalation
- Remote code execution
out_of_scope:
- Denial of service
- Rate limiting issues
- Automated scanning findings
- Configuration recommendations without demonstrated exploitability
rewards: none
evidence:
- {source: https://runware.ai/security-disclosure, kind: disclosure-page}
notes: >-
  Responsible Disclosure Program (no public bug bounty, no HackerOne/Bugcrowd).
  The security contact is published on the disclosure page behind Cloudflare
  email obfuscation; security@runware.ai is the reconstructed address. The
  automated probe returned none because /.well-known/security.txt is 404 and the
  page obfuscates the contact; this file is a docs-searched hit.