Email security@favqs.com. Please include:

• the affected URL, API endpoint, or app version;
• steps to reproduce it;
• what an attacker could gain;
• the account names you used for testing.

Please don't open a public issue or discuss the problem publicly until it's fixed.

We'll acknowledge your report within 5 business days and keep you updated until it's resolved. FavQs doesn't run a bug bounty, so we can't offer payment. We're glad to credit you once the fix ships, if you'd like.

In scope:

• https://favqs.com and https://www.favqs.com
• The FavQs API at https://favqs.com/api, all versions
• Repositories in this organization

Out of scope:

• Denial-of-service and load testing, spam, and social engineering
• Third-party services FavQs relies on, such as Stripe, Cloudflare, Slack, and AWS; please report those to the provider
• Reports from automated scanners without a demonstrated impact

• Use only accounts you own. Create test accounts as needed.
• Don't view, change, or delete data you don't own, beyond the minimum needed to show the problem. If you reach someone else's data, stop and report it.
• Don't change public content you didn't create, such as quotes and authors.
• Don't degrade the service for others, and keep automated requests slow.

If you research and report a vulnerability in good faith and follow this policy, we will:

• consider your research authorized, and not pursue or support legal action against you for it;
• set aside, for that research only, the parts of our Terms of Service that would otherwise forbid it, such as the rules against circumventing security measures and using automated tools;
• make it known that you acted with our authorization, if a third party takes legal action against you for research that followed this policy.

This covers FavQs only. It can't authorize testing of the third-party services listed as out of scope. If you're unsure whether something is allowed, ask us at security@favqs.com before you test it.