Found a security issue? Tell us. We'll thank you, not sue you.
FedM8 welcomes good-faith security research on our services. This page is our commitment: how to report, what we promise, and what's in scope.
How to report
| [email protected] — include steps to reproduce, affected URL, and impact. Machine-readable details: security.txt (RFC 9116). | |
| Acknowledgment | Within 3 business days. |
| Triage & first assessment | Within 10 business days, with an expected fix timeline. |
| Disclosure | Coordinated: we ask for a reasonable window to fix before public disclosure, and we will not ghost you — you get status updates until resolution. |
| Rewards | No paid bounty program today (we are a small veteran-owned company). With your permission we credit researchers on our acknowledgments page. |
Safe harbor
If you make a good-faith effort to comply with this policy during your research, we consider your research authorized. We will not pursue or support legal action against you for it, and if a third party raises action against you for activity conducted in accordance with this policy, we will make that authorization known. Good faith means: access only what you need to demonstrate the issue, do not modify or destroy data that is not yours, do not degrade the service for others, and give us reasonable time to fix before disclosure.
Scope
In scope
fedm8.com, ai.fedm8.com, test.fedm8.com, txt.fedm8.com and the services behind them: authentication, authorization, data exposure, injection, business-logic flaws.
Out of scope
Denial of service and volumetric attacks, spam, social engineering or phishing of FedM8 staff or users, physical attacks, third-party services we do not operate, and findings from automated scanners with no demonstrated impact.
What we ask
Never use a finding to access, alter, or exfiltrate another user's data. If you stumble into someone else's data, stop, report it immediately, and delete anything retained. Do not run tests that could degrade service — if you need to test something disruptive, ask first and we will set up a safe path.
Effective 2026-08-28 · FedM8 LLC · This policy is referenced from our security.txt and our certifications page.