Report a security issue

• » fohrkast.com and www.fohrkast.com.
• » The signed in app.
• » The public API (fohrkast.com/help/api).
• » The scanner releases Fohrkast publishes.

• » demo.fohrkast.com, which shows invented companies.
• » staging.fohrkast.com.
• » Status pages.
• » Third parties, such as Amazon Web Services, Google and Razorpay.
• » Findings that need physical access to a device, or a stolen device.

• » Use only accounts the researcher owns.
• » Reach no more data than needed to show the issue. On reaching personal data of anyone else, stop and report at once, and keep none of it.
• » No denial of service, no high volume automated scanning, no spam, and no social engineering of Fohrkast staff or customers.
• » Allow 90 days before any public disclosure, or less once the issue is fixed and the date agreed.

Write to tech@fohrkast.com with the URL or feature affected, the steps that reproduce the issue, the impact, and a contact for follow up.

• » Reports are acknowledged within 3 working days.
• » Updates follow until the issue is fixed.
• » Credit on this page for the researcher, if wanted.

Fohrkast runs no paid bug bounty at present.

Fohrkast will not pursue legal action against research done in good faith within these rules.