Security

How to tell us about a security vulnerability in the service, and what you can expect from us.

Report a vulnerability

Email support@farinu.com with what you found, the steps to reproduce it, and what an attacker could do with it. Please give us a reasonable time to fix it before you tell anyone else.

Scope

The app at app.farinu.com, the API at api.farinu.com, and this site at farinu.com. Out of scope: denial-of-service attacks, spam, social engineering, physical attacks, and the services of the companies that process data for us; report those to them.

Rules

Test only with accounts you created. Don't access, change, or delete other people's data, and stop as soon as you reach data that isn't yours, then tell us what you saw. Don't degrade the service for others, for example with scans that flood it.

Safe harbor

If you follow these rules in good faith, we consider your research authorized, won't take legal action against you over it, and will work with you to understand and fix the issue.

What to expect

We'll confirm your report within 3 business days, keep you updated while we fix it, and tell you when it's fixed. We don't pay rewards, but we'll gladly thank you publicly if you'd like.

The same contact details, for tools, are in our security.txt file: /.well-known/security.txt