Stratamesh

Program overview

Stratamesh schedules customer workloads across regional Kubernetes fleets and puts one control plane, one console and one CLI in front of them. Eleven thousand four hundred organisations run production traffic on it today. There were fewer than three hundred when this program opened in March 2018, and most of the policy below exists because of something that happened in between.

The control plane is the product, so the control plane is where the money goes. Anything that lets one tenant observe, influence or reach another is the most serious class of finding we accept, and that has been true across three versions of the reward table. The figures beside this policy are the real ones: 3,182 reports resolved, 761 researchers thanked, just over 3.05 million USD paid. Triage came back in-house in November 2025, and every report scored High or above gets an engineer from the owning service on the ticket the same day.

Testing rules and expectations

Create your own tenant at console.stratamesh.example. Trial tenants cost nothing and provision in about forty seconds; if you need two to show a crossing, make two and say in the report which one was the attacker.

• Twenty requests per second per source IP against the API, five against /v3/auth/*. Ask before anything heavier and we will usually agree a window. Unannounced load is blocked at the edge, and we do not lift a block while a session is running.
• Send X-Stratamesh-Research: <your handle> on every request and suffix test addresses with +bbp. Traffic we cannot attribute is handled as an intrusion until someone proves otherwise, which costs you an evening and costs us a bridge call.
• Stop at proof. One object identifier belonging to a tenant that is not yours settles the question. A thousand of them turns a bounty into an incident review with counsel in the room.
• Keep identifiers, not records. Delete anything you pulled within seven days and confirm it in the thread.
• Never: denial of service, resource-exhaustion experiments on shared nodes, social engineering of our staff or our customers, physical attempts, or testing aimed at the cloud providers underneath us.

If your testing breaks something, tell us in the report the same hour. A self-reported accident has never cost anyone a bounty here. The one concealed one ended a participation.

Proving write access

If you find a way to write, do not prove it by causing damage. Prove it with the smallest change that can be attributed to you and undone in the same minute.

• One or two punctuation characters. Delete a full stop, add a comma. Nothing longer, nothing visible, no payload, no changed number or amount.
• Only on a record you created yourself. Never another user's record, never site content, never anything the public can see.
• Revert within sixty seconds, in the same run, without being asked.
• Capture four states: before, after the change, after the revert, and an independent re-read confirming the revert held.
• If it cannot be reverted, do not change it. Report the write primitive and stop. A row count and a column list already prove database access.

Every request must carry headers that let us separate your traffic from a real attack in our logs:

X-Bug-Bounty:        stratamesh
X-Research-Account:  <the account you submit the report under>
X-Authorisation-Ref: <engagement or report reference>
X-Request-Id:        <unique per request>
User-Agent:          sentinel-research/<handle> (+<this page>)

scripts/proof_of_write.py performs exactly this sequence, refuses any host outside the scope above, refuses a diff longer than two characters, always attempts the revert, and writes a timestamped evidence file. Run it without --execute first, then attach the evidence to your report.

Safe harbor

Work that stays inside this policy is authorised work, and we will put that in writing for anyone who asks: your employer, your registrar, a hosting provider, a court. We have sent that letter twice since 2019 and neither researcher had to ask twice.

Good faith means you tested the assets listed above, stayed inside tenants you created, took the minimum the proof required, and gave us a chance to ship a fix before anyone else heard about it.

Authorisation ends the moment you pull another tenant's data past the point of proof, sell or trade a finding, use the access for anything other than proving the bug, or attach a price to the report. None of those are research and none of them are covered here.

Reward decisions

CVSS v3.1 picks the band and reachability sets the position inside it. A 9.8 that needs cluster-admin credentials you already hold will pay less than a careful 7.4 that reaches another tenant's object store from an unprivileged pod.

The first reproducible report takes the finding. Since February 2026 the duplicate window runs from the moment the earlier report was triaged rather than from the moment it arrived, because measuring from arrival let an untouched queue item beat a complete write-up. When we close something as a duplicate we name the report it duplicates and the date it was triaged.

Chains pay at the severity of the chain, with up to 25% added for the work of assembling it. A finding against the CLI or the Terraform provider that arrives with a patch we can merge earns a flat 1,500 USD on top.

Disclosure policy

Ninety days, counted from the day we triage a report as valid. Publish when the fix ships or when the window closes, whichever comes first. If we need longer we ask before day 75 with a reason and a date; node-image changes are the usual cause, because they roll region by region behind a maintenance calendar our customers set.

Redact tenant identifiers, internal hostnames, customer names and anything shaped like a key or token. We read drafts within five working days. We have never asked a researcher to soften a technical claim and we do not intend to start.

Report quality

• The asset and endpoint, with the full request including headers.
• Both tenant identifiers and the handle you sent in X-Stratamesh-Research.
• Numbered steps that start from a fresh trial tenant, with nothing skipped as obvious.
• One sentence on what the attacker gains, in terms of tenant data or control-plane privilege.
• The UTC window you tested in, so we can line it up against our own logs.
• Video only where timing is the point. For everything else a curl transcript is faster to read and faster to act on.