Security Disclosure

We welcome reports from security researchers on issues found in Scale Factory systems.

Out of scope:

  • Software version or banner disclosures
  • Self-XSS or CSRF on unauthenticated web forms
  • Disclosure or discovery of known public files or directories (for example, robots.txt, simple DNS enumeration)
  • Brute force attempts
  • Account enumeration
  • Email spoofing possibilities. Suggesting turning on SPF, DMARC, or DKIM isn’t welcome, though specific issues with those configurations are.


Contact the Scale Factory security team at

If you wish, you can encrypt your message using our PGP key.

Please include the following details in your report:

  • Detailed description of the issue, including the affected product/service and steps to reproduce the vulnerability
  • Any technical details and proof-of-concepts that can help us identify and resolve the issue
  • Details of the environments the issue was reproduced in
  • Your name/handle and contact information (we will keep it confidential and only use it to correspond about this disclosure)

We ask that you:

  • Report any vulnerability directly to us, and not attempt to exploit it for any purpose.
  • Avoid publicly disclosing details about the vulnerability until we have had sufficient time to resolve it.
  • Provide us a reasonable amount of time to resolve the issue before publicly disclosing it


While we value contributions to our security, we do not currently offer cash rewards or bounties for vulnerability reports. We may publicly acknowledge and credit researchers who comply with our policy, if desired.

Free Healthcheck

Get an expert review of your AWS platform, focused on your business priorities.

Book Now

Discover how we can help you.

Consulting packages

Advice, engineering, and training, solving common SaaS problems at a fixed price.

Learn more >

Growth solutions

Complete AWS solutions, tailored to the unique needs of your SaaS business.

Learn more >

Support services

An ongoing relationship, providing access to our AWS expertise at any time.

Learn more >