Draft — under legal review

Trust

Security and abuse reporting

Last updated: 4 October 2026

RightSide is operated by Poligon Tech. If you have found a vulnerability in RightSide, or an app hosted on RightSide is being used for abuse, tell us. This page explains how to report it, what we will do, and the rules for good-faith security research.

Reporting a vulnerability

Email [email protected]. Please include:

• what is affected (host name, CLI or MCP version, API route);
• the steps to reproduce it, and a proof of concept if you have one;
• what an attacker could achieve;
• how we can reach you, and whether you want to be credited.

Do not put another person's personal data, credentials or tokens in the report. If you had to see some to demonstrate the issue, describe it instead of copying it. We do not currently publish a PGP key. If your report is sensitive, send a short first message and we will agree a secure channel with you.

What we will do

• Acknowledge your report, normally within [3 business days — confirm].
• Investigate, keep you informed, and tell you when it is fixed.
• Credit you in the fix notes if you want, once the issue is resolved.

We ask you to keep the details confidential until we have released a fix, or for 90 days after your report, whichever comes first. If we need longer we will explain why and agree a date with you. RightSide does not run a paid bug bounty programme at this time.

Scope

In scope:

• the RightSide platform hosts: rightside.host, api.rightside.host, app.rightside.host, ops.rightside.host and get.rightside.host;
• the rightside CLI and the rightside-mcp server;
• the isolation between hosted apps, and between hosted apps and the platform (for example, one app reading another app's data, or an app reaching the control plane).

Out of scope:

• vulnerabilities in the code of a customer's own app on <slug>.rightside.host. Report those to the app's owner. If the app itself is malicious, report it as abuse;
• the infrastructure of our providers (for example Cloudflare, GitHub or Resend). Report those to the provider;
• denial-of-service, load or volumetric testing;
• social engineering, phishing or physical attacks against Poligon Tech staff or offices;
• reports from automated scanners with no demonstrated impact, and best-practice suggestions (such as a missing header) with no security impact.

Rules for good-faith research

• Only test with accounts, apps and data that you own. RightSide is invite-only. If you need a test account, ask us.
• Do not access, modify or delete data that belongs to someone else. If you reach other people's data by accident, stop, do not keep a copy, and tell us.
• Do not degrade the service for others: no denial of service, no high-volume automated scanning, no resource-exhaustion tests.
• Do not use a vulnerability beyond what is needed to show that it exists. Do not move deeper into our network, keep access, or install anything persistent.
• Do not run the things our Acceptable Use Policy forbids (for example malware or crypto mining), even as a test.
• Give us reasonable time to fix the issue before you disclose it.

Safe harbour

If you follow this policy in good faith, Poligon Tech will treat your research as authorised, will not pursue or support legal action against you for it, and will not suspend your account because of it. If someone else starts legal action about research that followed this policy, we will make it known that your activity was authorised by us. This safe harbour covers only Poligon Tech and RightSide. We cannot authorise testing of third-party systems.

Reporting abuse

Email [email protected] if an app hosted on RightSide is used for phishing, malware, spam, fraud, infringement or other illegal activity. Please include:

• the full URL (for example https://<slug>.rightside.host/login);
• when you saw it, with time zone;
• what is wrong, and any evidence such as email headers or screenshots.

Never send child sexual abuse material, even as evidence. Send only the URL. We will preserve the evidence and report it to the competent authorities.

We review abuse reports and act according to our Acceptable Use Policy. In urgent cases we disable the app first and investigate afterwards. If you are a rights holder with a copyright or trademark complaint, send it to the same address and identify the work and the infringing URL.

How RightSide is built

A short, factual summary. It is not a guarantee that the service is free of vulnerabilities.

• Customer apps are built and run on a separate runtime host, not on the host that runs accounts and the control plane.
• App containers run as a numeric non-root user, with a read-only root filesystem, all Linux capabilities dropped, no-new-privileges, and resource limits.
• Agent access tokens (from rightside login) are stored on our side only as hashes. Hosted-app passwords are stored as salted scrypt hashes.
• Session cookies are host-only (__Host- prefix), Secure and HttpOnly, so another app cannot set or read them.
• Build logs are passed through a redactor before they are shown, so values that look like credentials are hidden.
• Traffic to RightSide is encrypted with TLS.

See the Privacy Notice for what personal data we keep and for how long.