Skip to content
Open an account
Status

Fidorox is preparing to launch. Sign-up opens at launch, and products open in stages after it; every page says what each will do. Where we will open

Security · Disclosure

Report a vulnerability.

If you believe you have found a security problem in Fidorox, we want to hear from you, and we will work with you to fix it.

Our policy

How to report

Write to security@fidorox.com with what you found, where, and how to reproduce it. Our contact details are also published, as the standard asks, at /.well-known/security.txt.

What we promise

  • We confirm your report within three working days.
  • We tell you what we are doing about it, and when it is fixed.
  • We credit you when the problem is fixed, if you would like that.
  • We do not take legal action against research done in good faith under this policy.

What we ask

  • Test only against your own account; never access, change or delete another person’s data.
  • Do not degrade the service: no denial-of-service, no spam, no automated scanning that floods us.
  • No social engineering of our staff or customers, and no physical attacks.
  • Give us reasonable time to fix a problem before you tell anyone else.

In scope

fidorox.com, app.fidorox.com and their APIs. Other hosts and third-party services are out of scope; tell us about them anyway if you think they put our customers at risk.

Not a security problem

Reports of missing best-practice headers with no demonstrated impact, of software versions, or of the results of automated scanners alone. Please send us what you have shown to be exploitable.