Our approach
Fynix welcomes good faith reports that help us identify and address security vulnerabilities in services operated by Fynix. This policy describes how to report a suspected issue and what we ask researchers to do while investigating it.
How to report a vulnerability
Email [email protected] with the subject “Security Vulnerability Report”. Include a clear description of the issue, the affected URL or component, steps to reproduce it, its potential impact, and any relevant screenshots or logs. Do not include another person’s sensitive information unless strictly necessary to explain the issue.
Research boundaries
When testing, use only accounts and systems you own or have clear permission to test. Keep testing limited to what is necessary to demonstrate the issue. Do not access, copy, change, or delete other users’ data; disrupt services; perform denial of service testing; use social engineering; install malware; or continue testing after you have confirmed the issue.
Do not publicly disclose a vulnerability or details that could enable exploitation before Fynix has had a reasonable opportunity to investigate and address it. Coordinate publication with us. Do not test third party services, infrastructure, or customer systems under this policy unless their owner has separately authorised the testing.
What to expect
We will review reports in good faith and may contact you for clarification. We cannot guarantee a response time, a particular outcome, or a reward. Do not assume that a report has been accepted until Fynix confirms it.
Safe research
To the extent permitted by law, Fynix will not initiate legal action solely for good faith security research that follows this policy. This statement does not authorise access to systems or data, waive another party’s rights, or protect activity that violates applicable law or this policy.
Contact
Security reports can be sent to [email protected]. If a report contains sensitive details, say so in the subject and ask us for a secure method to share supporting material.