Report a vulnerability
If you’ve found a security problem in SpiritFox, please tell us. We review every report we receive.
- Send it to our security team at [email protected]. Include what you found, how to reproduce it, and what an attacker could do with it.
- Please give us reasonable time to fix it before you share it publicly. We’ll confirm we received your report within 5 business days and keep you updated until it’s fixed.
Good-faith research
We won’t take action against research done in good faith that follows this page:
- don’t access or change other people’s data;
- don’t disrupt the service;
- don’t use social engineering or physical attacks;
- stop and report as soon as you find something.
If you follow these rules, we treat your research as authorized, and we won’t pursue legal action over it. If someone else does, we’ll make clear that you were acting with our permission.
In scope
Our website, the dashboard and sign-in, and how your subscription link and account are protected.
Out of scope
- denial-of-service or load testing against our website or hosts;
- social engineering and physical attacks;
- spam;
- reports from automated scanners without a working proof;
- the apps of other developers (please report those to their authors).
Machine-readable details are in /.well-known/security.txt.
Protect your account
- Our official web addresses are listed in your dashboard. Bookmark it, and sign in from your bookmark.
- We never ask for your password by email, message or chat, and never send payment details that way. Anything that does is not us.
- Your subscription link is a password. Don’t share it. If it leaks, reset it in your dashboard.
- Use a unique password, ideally from a password manager.
- Get apps only from the links in your dashboard or your device’s official app store.