# Security

> How to report a vulnerability in WaveHouse Cloud, and our approach to security for the pre-launch site.

We take security seriously, even before launch. If you believe you've found a
vulnerability in this website or its waitlist infrastructure, we want to hear
from you.

## Reporting a vulnerability

Email **[security@wave-rf.com](mailto:security@wave-rf.com)** with details and,
if possible, steps to reproduce. We aim to acknowledge reports within a few
business days.

A machine-readable policy is published at
[`/.well-known/security.txt`](/.well-known/security.txt) per
[RFC 9116](https://www.rfc-editor.org/rfc/rfc9116).

## Safe harbor

We will not pursue legal action for good-faith security research that:

- respects user privacy and avoids degrading the service,
- does not access or modify data that isn't yours,
- gives us a reasonable chance to remediate before public disclosure.

Please **do not** run automated scanners that flood the waitlist, attempt denial
of service, or social-engineer our team.

## Our posture

- The site is static and served over HTTPS on Cloudflare; the only write path is
  the waitlist endpoint, which is rate-limited and deduplicated. It is
  deliberately open (no CAPTCHA) so agents acting on a person's behalf can sign
  them up; email confirmation (double opt-in) is the planned abuse control.
- We collect the minimum data needed (your email plus signup context). We store
  nothing derived from your IP address — not the raw address, not a hash of it;
  the IP is used only in-request as the rate-limit key.
- The open-source WaveHouse project has its own security model documented in its
  [repository](https://github.com/Wave-RF/WaveHouse).