Skip to content

Legal

Security & Responsible Disclosure

Last updated: 2026-09-26 · Policy expires: 2027-05-26

On this page
  1. Reporting a Vulnerability
  2. In Scope
  3. Out of Scope: Do Not Test
  4. Out of Scope: Known / Accepted
  5. Safe Harbor
  6. Bounty
  7. Hall of Fame
  8. Machine-Readable Contact

Reporting a Vulnerability

We take the security of FXI Studio, our users, and our infrastructure seriously. If you believe you have found a security vulnerability, please report it to us privately so we can investigate and remediate before public disclosure.

Primary contact: security@fxi.studio

Acknowledgment SLA: within 72 hours.
Triage SLA: within 5 business days.
Fix SLA (critical / high): patched in production within 14 days of confirmation.

In Scope

  • fxi.studio and www.fxi.studio — production web application
  • api.fxi.studio, cdn.fxi.studio, assets.fxi.studio — supporting subdomains
  • Authentication, billing, and asset-storage flows

Out of Scope — Do Not Test

  • Denial of service. No load, stress, volumetric, or resource-exhaustion testing against production.
  • Social engineering. No phishing, vishing, or pretexting against FXI staff, contractors, or users.
  • Physical security. Office, data-center, or hardware testing.
  • Other users' accounts or data. Test with accounts you own. Stop and report immediately if you observe another user's data.
  • Third-party services. Vulnerabilities in the platforms we build on (payment, cloud database, hosting and CDN, AI model and inference providers, and similar vendors) should be reported directly to that vendor.
  • Spam, mass enumeration, or scraping. Run targeted, low-volume tests only.
  • Automated scanners against production. Use staging when possible; ask us first.

Out of Scope — Known / Accepted

The following are tracked internally and are not eligible for new reports:

  • Missing X-XSS-Protection header (intentionally set to 0; modern browsers ignore it and CSP supersedes).
  • 'unsafe-inline' / 'unsafe-eval' on script-src — required for Next.js hydration + PostHog snippet; nonce-based CSP migration is planned.
  • Reports generated solely by automated scanners (Nessus, Acunetix, etc.) without proof of impact.
  • Best-practice findings without a concrete attack scenario.

Safe Harbor

We will not pursue civil action or refer good-faith security researchers to law enforcement for accidental, good-faith violations of this policy. We consider activities conducted consistent with this policy to be authorized conduct.

To qualify for safe harbor, you must:

  • Stay within the scope defined above.
  • Report the issue promptly — do not exploit, exfiltrate, or modify user data.
  • Give us a reasonable window to fix before public disclosure (default: 90 days).
  • Comply with all applicable laws.

Bounty

We do not currently operate a paid bug bounty. We do publicly credit researchers (with permission) in the Hall of Fame below and respond to all good-faith reports.

Hall of Fame

No researchers acknowledged yet. Be the first.

Machine-Readable Contact

See /.well-known/security.txt for the RFC 9116 contact record.