Replica Cyber takes the security of our products and services seriously. We welcome reports from security researchers and the public, and we will work with you in good faith to understand and resolve any issue quickly.

Scope

This policy covers:

  • the Replica platform and its components, including instances dedicated to individual customers;
  • Replica-published software and container images;
  • Replica-owned public websites and services, including replicacyber.com.

Testing instances you don't own is not authorized. Many Replica instances are dedicated to specific customers. Do not test an instance unless it is your own account or you have written permission from Replica. If you find an issue while legitimately using an instance, report it to us and we will coordinate with any affected customer. If you are unsure whether something is in scope, contact us before testing.

Out of scope: third-party services we use but do not operate. Report those to the vendor.

How to report

Email security@replicacyber.com. Please include:

  • a description of the issue and its potential impact;
  • step-by-step reproduction details (proof of concept, affected URL or endpoint, version);
  • any relevant logs, screenshots, or other artifacts.

If you need to send sensitive details, ask for our PGP key in your first message.

What to expect

  • Acknowledgement of good-faith reports within 3 business days.
  • Triage and validation, including a severity assessment, normally within 10 business days.
  • Status updates as we work on a fix.
  • Coordinated disclosure. We will agree a disclosure timeline with you. Our default target is remediation within 90 days, sooner for critical issues.

Safe harbor

We will not pursue or support legal action against researchers who:

  • make a good-faith effort to comply with this policy;
  • avoid privacy violations, destroying data, and degrading service;
  • do not access or modify data beyond the minimum needed to demonstrate the issue;
  • give us reasonable time to fix the issue before disclosing it publicly.

Please do not

  • run denial-of-service or resource-exhaustion tests;
  • perform social engineering, phishing, or physical attacks against Replica staff or facilities;
  • access, modify, or destroy data that is not your own;
  • test instances or accounts that are not your own without written permission;
  • disclose a vulnerability publicly before we have fixed it and agreed on timing with you.

Recognition

Replica does not currently run a paid bug-bounty program. We are grateful for every report and will publicly credit researchers who want to be acknowledged.

Last updated: 2026-11-02