Divulgación responsable

Documento de referencia en inglés. El cuerpo original se conserva sin modificar sus compromisos. Para aclaraciones sobre su alcance o vigencia, utiliza los contactos indicados en esta página.

We rely on the security research community to help keep Fluyio safe. If you have found a vulnerability, we want to hear from you and we will treat you fairly.

How to report

Email [email protected] with:

• A clear description of the issue.
• Steps to reproduce (a proof of concept if helpful).
• The endpoint, parameter or component affected.
• Your assessment of the impact.

We acknowledge reports as soon as we can — normally within a few business days — and keep you informed while we investigate and fix the issue.

Safe harbour

If you follow this policy, we will:

• Not pursue legal action against you for the research.
• Not contact law enforcement about you for the research.
• Treat your report as confidential until we coordinate disclosure together.
• Credit you publicly, if you want, when we publish the fix.

In return:

• Only test against your own Fluyio account, or accounts you have explicit written permission to test.
• Do not access, modify or destroy data that does not belong to you. If you do so accidentally, stop and report it.
• Do not run automated scans that disrupt the service (no aggressive fuzzers, no denial-of-service testing).
• Do not social-engineer Fluyio staff, customers or partners.
• Give us reasonable time to fix the issue before disclosing it publicly; 90 days is standard.

Rewards

Fluyio does not run a paid bug bounty programme at this time. We thank and, with your consent, publicly credit researchers who report valid issues.

Out of scope

• Social engineering, phishing and physical security.
• Denial-of-service attacks of any kind.
• Spam or content abuse (report those to [email protected]).
• Reports from automated scanners with no manual validation.
• Issues in third-party services (Cloudflare, Resend, Stripe, 360dialog): please report them to the provider directly.
• Missing best-practice headers and other findings with no demonstrable impact.

Hall of fame

We credit researchers who report valid issues, with their consent. Want to be first? Send us a report.