---
title: "Security"
description: "How to report security issues and check what is in scope. Read the safe harbor terms before testing."
url: "https://canary.fluxer.com/security"
language: "en"
last_updated: "2026-11-01"
---

> Index of Fluxer's official pages for AI agents: https://canary.fluxer.com/llms.txt
> Links to Fluxer pages go to their Markdown versions when they have one. For other Fluxer help, policy or blog links, remove any #section part and add .md to the end.

# Security

## Reporting a vulnerability

Email our [security contact](https://canary.fluxer.com/company-information.md), and include the affected area, the realistic impact and clear steps to reproduce it. Requests, logs, screenshots and environment details help, as long as they don't include unrelated personal data or secrets.

A report must show practical impact against a service we operate or against a supported self-hosted release. Source code review and local experiments can support that, but a theoretical issue with no realistic attack path isn't enough.

We don't have a bug bounty program. The repro bounties on [Fluxer Feedback](https://feedback.fluxer.com) are [points called XP](https://canary.fluxer.com/feedback-privacy.md) for reproducing ordinary bugs, and they have no monetary value.

## Scope

Applications, websites, services and infrastructure operated by Fluxer are in scope, including the domains `fluxer.app`, `fluxer.com`, `fluxer.gg`, `fluxer.gift`, `fluxerapp.com`, `fluxer.dev`, `fluxer.tools`, `fluxerusercontent.com`, `fluxerstatic.com`, `fluxer.media` and all of their subdomains.

Abuse of Fluxer features that gives someone unauthorized access, lets them keep that access or discloses data is also in scope. So are supported self-hosted releases, when the issue reproduces without custom patches or unsupported configuration.

Third-party systems we don't control are out of scope, and so are best-practice observations without a credible security impact, physical attacks, social engineering, phishing, ordinary UI bugs, feature requests and unsupported instances.

Don't run denial-of-service testing, noisy scanning, flooding, brute-force attempts or resource exhaustion. You can still report an application-layer issue that a small number of requests can prove, but you must never exploit it at scale.

## Safe harbor

Research done in good faith under this policy is authorized for the purposes of Swedish, EU, US and equivalent anti-hacking laws. We won't take legal action against you for it, and we'll confirm that it was authorized if a third party challenges it. This protection applies automatically, and we won't withdraw it retroactively.

It doesn't apply to extortion, intentional harm to users, service degradation or data destruction. If you're not sure whether a test is in scope, ask first.

## Testing safely

Test only with accounts, communities, systems and data you own or have permission to use. Don't access, change, keep or delete data that belongs to someone else. If that happens by accident, stop, don't keep the data and tell us.

Don't message users outside your test, scrape data, evade safeguards in bulk or trigger real billing, payments or notifications without asking us first. Use minimal access to prove impact, and delete personal data from tests once it's no longer needed.

## What happens after a report

We aim to reply quickly. Priority depends on demonstrated impact, affected users, exposed data and exploitability, and the more severe the issue, the faster we move. If we can't reproduce it, we'll ask for more detail before closing the report. For duplicates, the first report that clearly demonstrates the issue gets the credit.

Keep the report private until we've confirmed and fixed the issue, which typically takes up to 90 days. If a fix takes longer than that, we'll keep you informed and agree on a new timeline with you. We won't ask you to stay silent indefinitely. If we publish an advisory, we'll credit you and coordinate timing with you where we can.

---

Canonical page: https://canary.fluxer.com/security

Last updated on November 1, 2026