# Reporting a vulnerability

**Spinbox is experimental: APIs change and data may be lost.** What is built and what proves it is on [Status](https://spin-stack.github.io/website/reference/status.md); what Spinbox does not do is on [Limitations](https://spin-stack.github.io/website/overview/limitations.md).

> How to report a security problem in Spinbox privately, and what to include.

Report a vulnerability through a private security advisory on spin's repository, never in a
public issue or a pull request:

[github.com/spin-stack/spin/security/advisories/new](https://github.com/spin-stack/spin/security/advisories/new)

An advisory is seen only by you and the maintainers until it is published. The conversation, the
fix and the release that carries it happen there.

## What it covers

- **spin**: the control plane, runner, proxy, CLI, dashboard, and what runs inside a workspace.
- **spin-terraform-aws**: what the module creates in an AWS account, and the permissions it grants.
- **spin-machine**: QEMU, the guest kernel and the base image a workspace boots.
- **Spin OS**: the image every machine of an installation boots.

A problem in one of these that you found through another goes in spin's advisory too.

## What to include

- The release you found it in: `spin version` prints it.
- What an attacker needs to start with: a workspace of their own, an API key, a place on the
  installation's network, or nothing.
- What they get, and the steps that show it.

The model these are measured against is on [Security model](https://spin-stack.github.io/website/security.md), and the problems Spinbox
already knows of are on [Known gaps](https://spin-stack.github.io/website/reference/security/known-gaps.md): one of those is not a new report,
though a way to make it worse is.