Responsible Disclosure Policy

If you believe you’ve found a security vulnerability in any FASTNAT asset, please let us know immediately. We will work with you to resolve the issue quickly and responsibly.

• Make a good-faith effort to avoid privacy violations and service disruption.
• Give us a reasonable time to remediate before public disclosure.
• Do not access or modify data that isn’t yours.
• Comply with applicable laws and the rules of engagement below.

In Scope

• fastingnation.io (all subpages under https://fastingnation.io/)
• Static site behavior, service worker (sw.js), and PWA configuration
• Client-side storage (e.g., localStorage) and data exposure risks in the simulator

Out of Scope

• Third-party platforms (CDNs, fonts, external video hosts) unless misconfiguration is within our control
• Denial of Service, brute force on non-existent endpoints, or spam reports without evidence
• UI/UX issues without security impact, missing rate limits on non-sensitive, static endpoints

Rules of Engagement

• No data exfiltration or data destruction.
• No privacy invasion or access to accounts other than your own.
• No physical attacks, social engineering, or phishing of FASTNAT staff/users.
• No traffic flooding or service disruption.
• Coordinate timelines for any disclosure; we prefer 30–90 days depending on severity.

Safe Harbor

If you follow this policy and act in good faith, we will not pursue legal action against you for your research on in-scope systems. This safe harbor does not apply to actions that are unlawful or harmful (e.g., data theft, extortion, or disruption).

Response Targets

• Acknowledgement: within 72 hours
• Initial assessment: within 7 business days
• Remediation plan: within 14–30 days depending on severity and scope

These are targets, not guarantees, but we strive to meet or exceed them.

How to Report

1. Email us at security@fastingnation.io
2. Optionally encrypt using our PGP key (see below)
3. Include: affected URL(s), steps to reproduce, impact, and any proof-of-concept
4. Provide a safe way for us to reproduce without accessing third-party data

Recognition

We appreciate researchers who help keep users safe. With consent, we may add your name or handle to a future Hall-of-Fame.

Legal Notes

• Do not retain, share, or publish sensitive data discovered during research.
• Export-controlled, privacy, or medical data must not be accessed or exfiltrated.
• By submitting a report, you grant FASTNAT the right to use the information to improve security.

Contact