Security & Responsible Disclosure

Last updated: 2026-06-29

Reporting a vulnerability

If you believe you have found a security vulnerability in Cloud Doctor, please email support@getclouddoctor.com with details and reproduction steps. Please do not publicly disclose until we have had a reasonable opportunity to respond. We aim to acknowledge reports within 2 business days and to provide a remediation timeline after triage.

Our security posture

• Authentication: Clerk-issued JWTs verified fail-closed (RS256/JWKS). We do not store user passwords.
• Tenant isolation: every tenant-owned read/write is scoped to the authenticated user/tenant; cross-tenant access is treated as a defect with regression tests.
• Secrets: cloud credentials and notification tokens are encrypted at rest (Fernet) and never returned through the API. The encryption key is managed in a secrets manager, not in source.
• Cloud access: tenant cloud data is accessed via short-lived STS AssumeRole credentials; failed role assumption fails closed (no platform credential fallback).
• Webhooks: AWS SNS payloads are X.509 signature-verified; Razorpay, Slack, and GitHub webhooks are signature-verified. All are idempotent (replay-protected).
• Transport: TLS in transit; the data layer is not publicly reachable.

Scope

In scope: the Cloud Doctor application, API, and infrastructure we operate. Out of scope: third-party providers (Clerk, Razorpay, AWS) — report those to the respective vendor.