Report Abuse & Security

Found abuse of our platform, or a security vulnerability? Tell us — we take it seriously and we won't punish good-faith reporters.

Email security@foxyaudit.tech →

What to report

• Security vulnerabilities — a bug that could expose data, break tenant isolation, or let someone tamper with the audit chain.
• Abuse of the service — accounts using Foxy Audit for illegal activity, attacks on the platform, spam, or to deceive third parties.
• Data concerns — if you believe your data, or someone else's, is being handled improperly.

How to reach us

Email security@foxyaudit.tech, with Abuse or Security in the subject. Please include:

• A clear description of the issue and its impact.
• Steps to reproduce, or the account/URL involved.
• Any logs, screenshots, or proof-of-concept — but do not include others' personal data beyond what's needed to explain the issue.
• How we can contact you for follow-up.

Responsible disclosure — our commitment

If you research in good faith and follow this policy, we will not pursue legal action against you. In return, please:

• Give us reasonable time to investigate and fix before disclosing publicly.
• Only access the minimum data needed to demonstrate the issue — never view, modify, or exfiltrate other users' data.
• Avoid privacy violations, service degradation, denial-of-service, and any destruction of data.
• Do not run automated scanners against production without prior arrangement.

What is in scope

The safe harbour above applies to the systems we run:

• Our four deployed sites — foxyaudit.tech, app.foxyaudit.tech, admin.foxyaudit.tech, and checkout.foxyaudit.tech.
• The published foxy-audit Python SDK on PyPI, including its source distribution.

Reports are welcome against what is deployed now and the most recent published SDK release. Older releases are not maintained.

What is out of scope

• Third-party services we integrate with rather than operate — Paddle, Brevo, Google sign-in, and the AI model providers. Report those to them; tell us too if our integration is what makes the issue reachable.
• Volumetric denial of service, and any testing that degrades the service for other people.
• Social engineering, physical access, and attacks on our people's own machines or accounts.
• Automated scanner output with no demonstrated impact, including missing hardening headers on static pages where you cannot show what they enable.
• Self-XSS, and issues that need a victim to paste attacker-supplied content into their own developer console.

What happens next

We aim to acknowledge reports quickly, keep you updated as we investigate, and fix confirmed issues as fast as we responsibly can. For confirmed vulnerabilities, we're glad to credit reporters who want recognition.