Reporting a vulnerability
Email security@fluxer.com and tell us the affected area, the realistic impact and clear steps to reproduce it. Requests, logs, screenshots and environment details help, as long as they don't include unrelated personal data or secrets.
A report must show practical impact against a service we operate or against a supported self-hosted release. Source code review and local experiments can support that, but a theoretical issue with no realistic attack path isn't enough.
Encrypting your report
Encryption is optional, and we read plain email reports the same way. To encrypt your report, use our OpenPGP key and check that it has this fingerprint:
A160 0F28 E3D9 BB7E 30D8 4026 970D 864D 50EE A45D
Scope
Applications, websites, services and infrastructure operated by Fluxer are in scope, including the domains fluxer.app, fluxer.com, fluxer.gg, fluxer.gift, fluxerapp.com, fluxer.dev, fluxer.tools, fluxerusercontent.com, fluxerstatic.com, fluxer.media and all of their subdomains.
Abuse of Fluxer features that gives someone unauthorised access, lets them keep that access or discloses data is also in scope. So are supported self-hosted releases, when the issue reproduces without custom patches or unsupported configuration.
Out of scope
Third-party systems we don't control are out of scope, and so are best-practice observations without a credible security impact, physical attacks, social engineering, phishing, ordinary UI bugs, feature requests and unsupported instances.
Don't run denial-of-service testing, noisy scanning, flooding, brute-force attempts or resource exhaustion. You can still report an application-layer issue that a small number of requests can prove, but you must never exploit it at scale.
Testing safely
Test only with accounts, communities, systems and data you own or have permission to use. Don't access, change, keep or delete data that belongs to someone else. If that happens by accident, stop, don't keep the data and tell us.
Don't message users outside your test, scrape data, evade safeguards in bulk or trigger real billing, payments or notifications without asking us first. Use minimal access to prove impact, and delete personal data from tests once it's no longer needed.
Safe harbour
Research done in good faith under this policy is authorised for the purposes of Swedish, EU, US and equivalent anti-hacking laws. We won't take legal action against you for it, and we'll confirm that it was authorised if a third party challenges it. This protection applies automatically, and we won't withdraw it retroactively.
It doesn't apply to extortion, intentional harm to users, service degradation or data destruction. If you're not sure whether a test is in scope, ask first.
What happens after a report
We aim to reply quickly. Priority depends on demonstrated impact, affected users, exposed data and exploitability, and the more severe the issue, the faster we move. If we can't reproduce it, we'll ask for more detail before closing the report. For duplicates, the first report that clearly demonstrates the issue gets the credit.
Disclosure
Keep the report private until we've confirmed and fixed the issue, which typically takes up to 90 days. If a fix takes longer than that, we'll keep you informed and agree on a new timeline with you. We won't ask you to stay silent indefinitely. If we publish an advisory, we'll credit you and coordinate timing with you where we can.
Responsible vulnerability disclosure programme
This policy is Fluxer's responsible vulnerability disclosure programme. It isn't a bug bounty programme and has no set rewards. Apart from the credit described above, we decide case by case whether and how to thank or reward someone for a report.
Select people with relevant security experience have tested Fluxer privately since the private alpha in July 2023. Since the public beta in January 2026 and the wave of new accounts in February, many more security researchers have tested Fluxer's code and services and reported vulnerabilities. Some of them have found vulnerabilities in larger platforms, such as Discord. We keep improving Fluxer's security with their reports.
The repro bounties on Fluxer Feedback are points called XP for reproducing ordinary bugs, and they have no monetary value. They aren't part of this programme.