Report a vulnerability
How to report a security issue in Kodela, and what happens after you do.
1 · Received
You send what you found, how to reproduce it, and what you think it affects.
2 · Acknowledged
We acknowledge the report and tell you what we are doing about it.
3 · Fixed
We work on a fix and keep you told what we are doing about it.
4 · Disclosed
Fixed vulnerabilities will be published as advisories on this page.
What to include
- What you found, and the Kodela component it is in.
- How to reproduce it, on your own installation.
- What you think it affects: which boundary it crosses, which credential it reaches.
Good-faith research
We will not pursue good-faith research that avoids privacy violations, data destruction and service disruption, and stays on your own installation. We do not run a paid bug bounty.
Scope
The Kodela software, running on an installation you operate. Before you report, read the known gaps: those paths are already public, with what limits each one. A new way through one of them is still worth reporting.
Bundled third-party tools, such as the browser terminal, the browser IDE and the vendor agent CLIs, have their own maintainers. Report an issue in one of them upstream; tell us too if Kodela's configuration makes it worse.
Advisories
No advisories published. As of 2026-09-28. Fixed vulnerabilities will be listed here, newest first.
What this does not include yet
- No separate security address. Reports go to the general address, contact@kodela.app.
- No published response times. None is published yet.
- No encryption key for reports, and no
security.txtyet. - No paid bug bounty.