Security

1. Reporting a vulnerability

Write to security@wheelmachine.ai. Tell us what you found, where, how to reproduce it, and what someone could do with it. We confirm that we have your report within 3 business days, keep you told of our progress, and tell you when it is fixed. If you wish, we thank you by name when we write about the fix.

We do not run a paid bug bounty.

2. What is in scope

• wheelmachine.ai, app.wheelmachine.ai, api.wheelmachine.ai, docs.wheelmachine.ai and status.wheelmachine.ai;
• the addresses of your own machines under run.wheelmachine.ai;
• the command line wm, the MCP server wm-mcp, and the Python and TypeScript libraries.

Out of scope: other people's machines and data; denial of service; spam; tricking or pressuring people; physical attacks; and the services of the companies we use, which you should report to them.

3. The rules

• Test only against your own account and your own machines.
• If you reach anyone else's data, stop, do not keep or share it, and tell us at once.
• Do not harm the service or slow it down for others.
• Give us a reasonable time to fix a problem before you tell anyone else - 90 days, unless we agree another time with you.
• Follow the Acceptable Use Policy, except where this policy allows more.

4. Safe harbour

If you research our service in good faith and follow this policy, we consider your research authorised, we will not take legal action against you or report you to law enforcement for it, and where it breaks other rules of ours only as this policy allows, we waive those rules for it. If someone else takes legal action against you for research that followed this policy, we will make it known that you followed it.

We cannot authorise research on other people's systems, and cannot bind them: our suppliers and our other customers may take action of their own. If you are unsure whether something is allowed, ask us first.

5. How we protect the service

• What you send us travels encrypted, over HTTPS or SSH.
• Each machine is kept apart from every other.
• We keep only a one-way code of each API key and sign-in cookie, so they cannot be read back. A key can be limited to what it needs, and to some projects.
• Secrets and AI keys are kept encrypted. A secret you give a machine is inside it; AI keys and secrets kept outside are not, and are added on the way out, only to the hosts they are for.
• Machines' files in our storage are encrypted, and the storage company cannot read them.
• Each machine's internet can be on, off, or open only to the sites you list, and it reaches your team's repositories and folders either way. Off, it looks up no names, reaches nothing else, and its public ports answer only your keys and the links you make. A push from it can still start a repository's own CI, which has its own internet.
• An audit log records what is done in each account, kept as it was written.

6. Incidents

If a security incident puts your data at risk, we tell you without undue delay. We report incidents to India's CERT-In within 6 hours of noticing them, and to data protection authorities as the law requires. See the Privacy Policy.