If you believe you have found a security vulnerability in FaxToFax, please tell us at security@faxtofax.com. If you act in good faith and follow this policy, we will not take legal action against you, we will work with you to understand and fix the issue, and we will keep you informed. Please do not access other people's data, disrupt the service, use social engineering, or make the issue public before it is fixed.
1. Scope
This policy covers faxtofax.com and the FaxToFax web application and interfaces served from it. The following are out of scope:
- services operated by our providers, such as Cloudflare, our telecommunications carrier and Stripe; please report issues in their services to them directly;
- the public telephone network and other parties' fax machines and services; and
- our offices, staff and customers, including through social engineering or physical attacks.
2. How to report
Email security@faxtofax.com with:
- a description of the vulnerability and where it is (for example, the URL or feature);
- step-by-step instructions to reproduce it, with a proof of concept if you have one;
- the impact you believe it has; and
- how to contact you, and whether you would like to be credited.
Do not include other people's personal data in your report. If you need to share sensitive details, say so in your first email and we will arrange a secure way to receive them.
3. Rules for testing
- Test only against accounts you own, or have the account owner's explicit permission to test, and use only test data. Never use real patient or client information.
- Do not access, change, delete or keep data that belongs to anyone else. If you come across someone else's data, stop, do not save or share it, report it to us immediately, and delete any copies you have.
- Do not send faxes to numbers you do not own or control, and do not generate large volumes of faxes or calls. This avoids junk faxes to third parties and telephone charges.
- Do not carry out denial-of-service attacks, load testing, or anything else that degrades the Service for others.
- Do not use social engineering, phishing or physical attacks, and do not test our providers' systems.
- Use automated scanning tools only at a gentle rate that does not create excessive traffic.
- Do only what is needed to confirm the vulnerability. Do not move further into our systems, and do not install backdoors or other persistent access.
- Do not publicly disclose or share details of the vulnerability until we have fixed it and agreed a disclosure date with you.
- Follow all applicable laws.
4. Reports we are unlikely to act on
Unless you can show a real security impact, the following are usually not treated as vulnerabilities: missing security headers or cookie flags on their own; clickjacking on pages with no sensitive actions; self-XSS; version or banner disclosure; email domain configuration reports (SPF, DKIM, DMARC) without a working attack; unvalidated output from automated scanners; and issues that require a compromised device or an outdated browser.
5. What you can expect from us
- We will acknowledge your report within 3 business days.
- We will give you an initial assessment within 10 business days.
- We will keep you informed of our progress and tell you when the issue is fixed.
- We aim to fix valid vulnerabilities as quickly as their severity requires, and will agree a public disclosure date with you, normally after a fix is in place and generally within 90 days of your report.
- With your permission, we will credit you when we disclose the issue.
This policy does not include a paid bug bounty.
6. Safe harbour
If you make a good-faith effort to follow this policy:
- we will consider your research authorized, and we will not bring or support legal action against you for it, including under anti-hacking or anti-circumvention laws or for breach of our Terms of Service or Acceptable Use Policy;
- we waive restrictions in our Terms of Service and Acceptable Use Policy that would otherwise prevent the testing this policy allows; and
- if a third party brings legal action against you for activity that complied with this policy, we will make it known that your activity was authorized by us.
We cannot authorize testing of systems we do not own, and we cannot bind third parties or public authorities. If you are unsure whether something is allowed, ask us at security@faxtofax.com before you do it.
7. Changes
We may update this policy from time to time. The version on this page applies at the time of your research. See also our Security Overview.