Reporting a vulnerability
Email the security address on our company information page. Include the affected area, the realistic impact and clear steps to reproduce it. Requests, logs, screenshots and environment details help if they expose no unrelated personal data or secrets.
A report must show practical impact against a service we operate or against a supported self-hosted release. Source code review and local experiments can support that, but a theoretical issue with no realistic attack path isn't enough.
We don't have a bug bounty program. The repro bounties on Fluxer Feedback are XP points for reproducing ordinary bugs, and they have no monetary value.
Scope
Applications, websites, services and infrastructure operated by Fluxer are in scope, including the domains fluxer.app, fluxer.com, fluxer.gg, fluxer.gift, fluxerapp.com, fluxer.dev, fluxer.tools, fluxerusercontent.com, fluxerstatic.com, fluxer.media and all of their subdomains.
Abuse of Fluxer features that enables unauthorized access, persistence or data disclosure is also in scope, as are supported self-hosted releases when the issue reproduces without custom patches or unsupported configuration.
Third-party systems we don't control are out of scope. So are physical attacks, social engineering, phishing, ordinary UI bugs, feature requests, unsupported deployments and best-practice observations without a credible security impact.
Don't run denial-of-service testing, noisy scanning, flooding, brute-force attempts or resource exhaustion. You can still report an application-layer issue that a small number of requests can prove, but you must never exploit it at scale.
Safe harbor
Research done in good faith under this policy is authorized for the purposes of Swedish, EU, US and equivalent anti-hacking laws. We won't take legal action against you for it, and we'll confirm that it was authorized if a third party challenges it. This protection applies by default, and we will not withdraw it retroactively.
It doesn't apply to extortion, intentional harm to users, service degradation or data destruction. If you're not sure whether a test is in scope, ask first.
Testing safely
Test only with accounts, communities, systems and data you own or have permission to use. Don't access, change, keep or delete data that belongs to someone else. If that happens by accident, stop, don't keep the data and tell us about it.
Don't message users outside your test, scrape data, evade safeguards in bulk or trigger real billing, payments or notifications without asking us first. Use minimal access to prove impact, and delete personal data from tests once it's no longer needed.
What happens after a report
We aim to reply quickly. Priority depends on demonstrated impact, affected users, exposed data and exploitability, and the more severe the issue, the faster we move. If we can't reproduce it, we'll ask for more detail before closing the report. For duplicates, the first report that clearly demonstrates the issue gets the credit.
Keep the report private until we've confirmed and fixed the issue, which typically takes up to 90 days. If a fix takes longer than that, we'll keep you informed and agree on a new timeline with you. We won't ask you to stay silent indefinitely. If we publish an advisory, we'll credit you and coordinate timing with you where we can.