Security and responsible disclosure
If you believe that you have found a security vulnerability in ActionFeed, please report it to us privately. This policy explains how.
How to report
Email security@actionfeed.net with a description of the issue, the steps to reproduce it, the affected URL, app version or endpoint, and any proof-of-concept. We may contact you for more information. We do not commit to a response time or to any particular outcome.
In scope
- actionfeed.net, app.actionfeed.net and mcp.actionfeed.net
- The ActionFeed iOS and Android apps, current versions
- The public API, the MCP server, and our official SDKs and command-line tools
- The creation, storage and verification of signed approvals
Out of scope
- Denial of service, load or stress testing, and spam
- Social engineering, phishing and physical attacks against our people, offices or users
- Findings that need a rooted, jailbroken or otherwise compromised device
- Third-party services, including Apple, Google, Cloudflare and integrations that we do not operate
- Missing best-practice headers or settings without a demonstrated security impact
- Reports from automated scanners without a working proof
Rules
- Test only against accounts and data that you own or have explicit permission to use.
- Do not access, change, keep or delete data that belongs to others. If you reach such data, stop and tell us.
- Do not degrade or interrupt the Service.
- Do not disclose the issue to anyone else until we tell you in writing that you may.
- Follow our Terms of service and all applicable laws.
Safe harbour
If you act in good faith and follow this policy, we will not pursue legal action against you for your research, at our sole discretion. This is not permission to break any law and does not bind any third party. If you are unsure whether something is allowed, ask us first.
Rewards
We do not run a paid bounty program. Any reward or acknowledgment is at our sole discretion.
Changes
We may change this policy at any time by posting a new version on this page.