Security Disclosure Policy

Production services only:

• checkfox.eu, including the web application;
• api.checkfox.eu, the public API and the MCP server;
• public.checkfox.eu, where customers publish their documents;
• the latest published version of the CheckFox browser extension.

• Staging and test environments.
• The services of third parties, such as the hosting, payment or email providers. Report those to the provider concerned.
• Denial of service, load testing, and anything that degrades the service for other users.
• Social engineering, phishing, and physical attacks.
• Reports from automated scanners with no demonstrated impact.
• Missing security headers, TLS settings or email records, unless you can show a concrete way to exploit them.
• Clickjacking on pages with no sensitive action, self-XSS, and the disclosure of software versions.

• Test only with accounts you own. A free account is enough, and you may create two to test the separation between workspaces.
• Never access, modify or delete another user's data. If you reach some by accident, stop there, keep no copy, and say so in your report.
• Keep automated requests to a reasonable rate.
• Do not leave anything behind: no backdoor, no persistent change, no content visible to other users.
• Do not make the vulnerability public before it is fixed, or before 90 days have passed since your report, unless we agree otherwise.

Write to the address at the bottom of this page, in English or French, with:

• a description of the vulnerability and of its impact;
• the steps to reproduce it, and the address or endpoint concerned;
• how to contact you, and whether you would like to be credited, and under which name.

If your report has to include sensitive data, send a first message without it and we will agree on a way to share it.

• An acknowledgement within 3 business days.
• A first assessment within 10 business days: whether the issue is confirmed, and how severe I consider it.
• Updates until the issue is fixed, and a message when it is.
• Critical issues take priority over all other work.

If you act in good faith and follow this policy, I consider your research authorised. I will not take legal action against you or file a complaint about it, and if a third party does, I will make it known that you acted with my authorisation.

This commitment binds me only: it cannot bind public authorities or third parties. If you are unsure whether something is allowed, ask before doing it.

CheckFox is a small company and cannot offer paid rewards yet. With your agreement, I credit you by name or handle in the changelog entry of the fix, and publicly thank you for your help.

The contact address and this policy are also published in security.txt, following RFC 9116.