Security Response
Last updated
We appreciate your help
Keeping customer data safe is a top priority, and reports from customers and security researchers help us do it.
Reporting a vulnerability
Email security@instatus.com with a description of the issue, the steps to reproduce it, and its potential impact. We'll acknowledge your report, usually within 72 hours. If you don't hear back, follow up or ping us on X @instatus.
To report abuse of Instatus by someone else, such as a phishing status page, see our Acceptable Use Policy.
What happens next
- We acknowledge your report and tell you how to follow its progress.
- We investigate, confirm the issue and assess its severity and impact, working with you to make sure we understand it.
- We fix confirmed issues based on severity, and notify affected customers where needed.
- We won't disclose an issue until it has been fixed. With your permission, we'll credit you for the discovery.
- Rewards for eligible reports are at our discretion, based on severity and the quality of the report.
Safe harbor
If you research and report a vulnerability in good faith and follow this policy, we won't pursue legal action against you or ask law enforcement to investigate you. Please:
- only test against your own account and data, and stop as soon as you've confirmed an issue;
- never access, change or delete other customers' data, and tell us right away if you encounter any;
- not run denial of service, load or automated volume tests, social engineering, or physical attacks;
- not use our monitors or notifications to attack third parties; and
- give us reasonable time to fix the issue before you disclose it publicly.