# Security

> How to report a vulnerability in WaveHouse Cloud, and our approach to security for the pre-launch site.

Last updated 2026-06-26

We take security seriously, even before launch. If you believe you've found a
vulnerability in this website or its waitlist infrastructure, we want to hear
from you.

## Reporting a vulnerability

Email **[security@wavehouse.cloud](mailto:security@wavehouse.cloud)** with details and,
if possible, steps to reproduce. We aim to acknowledge reports within a few
business days.

A machine-readable policy is published at
[`/.well-known/security.txt`](/.well-known/security.txt) per
[RFC 9116](https://www.rfc-editor.org/rfc/rfc9116).

## Reporting abuse of a customer endpoint

Each WaveHouse Cloud project is served from its own subdomain of **wavehouse.app**, and the
content returned there is defined by the customer who owns that project — not by us. If a
`<project>.wavehouse.app` endpoint is serving phishing pages, malware, or anything else
malicious, report it to **[abuse@wavehouse.cloud](mailto:abuse@wavehouse.cloud)** with the full
hostname and, where possible, a URL or capture. We act on abuse reports on the same timeline as
vulnerability reports. Use this address rather than the one above — a tenant abusing the
platform and a flaw in our own software are different problems with different responses.

Our own site, console, API and documentation are on **wavehouse.cloud**, a deliberately
separate registrable domain; nothing customer-controlled is ever served from it.

## Safe harbor

We will not pursue legal action for good-faith security research that:

- respects user privacy and avoids degrading the service,
- does not access or modify data that isn't yours,
- gives us a reasonable chance to remediate before public disclosure.

Please **do not** run automated scanners that flood the waitlist, attempt denial
of service, or social-engineer our team.

## Our posture

- The site is static and served over HTTPS on Cloudflare; the only write path is
  the waitlist endpoint, which is rate-limited and deduplicated. It is
  deliberately open (no CAPTCHA) so agents acting on a person's behalf can sign
  them up; email confirmation (double opt-in) is the planned abuse control.
- We collect the minimum data needed (your email plus signup context). We store
  nothing derived from your IP address — not the raw address, not a hash of it;
  the IP is used only in-request as the rate-limit key.
- The open-source WaveHouse project has its own security model documented in its
  [repository](https://github.com/Wave-RF/WaveHouse).