Skip to content

Legal

Responsible Disclosure

Last updated Version 1.0

In short

  • If you find a security weakness in FireFunc, write to admin@firefunc.com. A person reads every report and answers it.
  • Test only against accounts and data that are yours, and stop as soon as you reach anything that is not.
  • If you act in good faith and within this policy, we will not take legal action against you, and we will credit you if you want us to. FireFunc does not pay cash bounties.
Contents
  1. 1. What is in scope
  2. 2. What is out of scope
  3. 3. How to test
  4. 4. How to report
  5. 5. What happens next
  6. 6. Safe harbor
  7. 7. Recognition
  8. 8. security.txt
  9. 9. Contact

1. What is in scope

  • firefunc.com: the website, the sign-in pages, the application you sign in to, and every API path it serves, including the webhook addresses and the programmatic API under /api/.
  • The FireFunc API at the Amazon API Gateway address that the runner and the AI engines connect to.
  • The runner: the @firefunc-agent/runner package on npm, and what it does on the machine it is installed on.
  • The staff console at admin.firefunc.com, as far as it can be reached without a staff account. Do not try to guess, collect or reuse staff credentials.

A weakness in how FireFunc uses another service — how it verifies a webhook from GitHub, say, or what it asks of a connected account — is in scope. A weakness in the other service itself is not; see below.

2. What is out of scope

  • Denial of service: load, volume or stress testing, and anything else that slows FireFunc down or takes it offline for others.
  • Social engineering or phishing of FireFunc’s staff, its customers or their people, and any physical attempt.
  • Other customers’ data and accounts. Reaching, changing, keeping or deleting them is never allowed, even to prove a point: stop at the first sign that you can, and report it.
  • Output from automated scanners without a working proof that the finding can be exploited.
  • Sending the early access form or invitations in bulk.
  • The services FireFunc runs on or connects to — Amazon Web Services, Google Workspace (our mailbox), GitHub, Jira, Linear, Sentry, Slack, Figma, Microsoft Teams, and the AI engines and their vendors. Report a weakness in one of them to that vendor.

3. How to test

  • Use only accounts you own or have been given to test with. Sign-up is closed while FireFunc is in early access: if you need a workspace to test in, write to us first and ask.
  • Pair only machines you own, and point agents only at repositories and tool accounts you control.
  • Do no more than you need to show the problem. Do not use one weakness to look for others behind it, and do not keep any data you reach that is not yours.
  • Keep the details to yourself until we have fixed the problem, or until we have agreed a date with you to publish them.

4. How to report

Write to admin@firefunc.com, with a subject that starts “Security:”. Please include:

  • what is affected: the address, the API path, or the runner’s version and the machine’s operating system;
  • the steps that reproduce the problem, and what an attacker could do with it;
  • your proof: the requests and responses, screenshots or a short script;
  • whether you reached any data that is not yours, and what you did with it;
  • how you would like to be credited, if at all.

Please do not attach other people’s data. We do not publish an encryption key yet: if the details are sensitive, send a first message without them, and we will agree with you how to receive them.

5. What happens next

  • A person at FireFunc reads your report and tells you it has arrived. We do not promise a response time.
  • We tell you whether we can reproduce the problem and how serious we judge it to be, and we keep you informed while we fix it. How quickly a fix follows depends on its severity; we will tell you what we plan.
  • We tell you when it is fixed, and agree with you when and how its details can be published.

6. Safe harbor

If you research FireFunc in good faith and within this policy, we consider your research authorized. We will not take legal action against you over it, and we will not ask anyone else to — whether under laws against computer misuse or circumventing technical measures, or under our Terms of Service and Acceptable Use Policy. If someone else takes action against you over research that followed this policy, we will make it known that we authorized it.

This covers FireFunc’s own systems only. We cannot authorize testing of the services we run on or connect to, and it does not cover anything outside this policy. If you are unsure whether something is allowed, ask us first at admin@firefunc.com.

7. Recognition

With your permission, we will thank you by the name or handle you choose, in a list of acknowledgements that this page will carry once there is someone to thank. FireFunc does not run a bug bounty and does not pay for reports.

8. security.txt

The same contact details are published in the standard machine-readable form at firefunc.com/.well-known/security.txt. How FireFunc is built and protected is on the Security page.

9. Contact

FireFunc is operated by SoftHawker LLC. Reports and questions about this policy go to admin@firefunc.com.