VULNERABILITY DISCLOSURE
Found a security problem? Tell us first.
We welcome reports from security researchers and customers. This page says what to report, how to test without harming anyone, and what you can expect from us.
How to report
Please include what is affected, the steps to reproduce the problem, what an attacker could do with it, and how to reach you. Screenshots or a short proof of concept help. Don't send passwords or anyone else's data by email. Ask us for a secure way to share sensitive evidence.
What is in scope
- frenimiguard.com, including the app and its API under /api/;
- the FreNiMiGuard agents and installers published at frenimiguard.com/agent/;
- how the agent verifies commands, approvals and its own updates.
These are out of scope: other FreNiMi websites, the services we use (Stripe, Resend and DigitalOcean, whose own programmes take those reports), denial-of-service testing, spam, social engineering, physical attacks, and scanner output that doesn't show a real problem.
Rules for testing
- Test only with your own workspace. A free workspace is available from the sign-up page.
- Don't access, change or delete anyone else's data. If you reach another customer's data by accident, stop, don't keep a copy, and tell us.
- Don't degrade the service: no denial-of-service, no high-volume automated scanning, no repeated sign-in attempts against other people's accounts.
- Give us a reasonable time to fix the problem before you publish anything. We ask for 90 days, or less once a fix is out and we've agreed a date with you.
What you can expect from us
- We confirm we received your report within 3 business days.
- We tell you within 10 business days whether we can reproduce it and how serious we think it is.
- We keep you updated until it is fixed, and tell you when it is.
- With your permission, we thank you by name on this page once the fix is out.
We don't pay bounties at this time.
If you make a good-faith effort to follow this policy, we consider your research authorised. We won't take or support legal action against you for it, and if a third party takes action against you for research that followed this policy, we will make clear that it was authorised.
Thank you
No vulnerability reports have been received yet. People who report a confirmed issue and agree to be named will be listed here.
Published October 27, 2026. Read more about how FreNiMiGuard protects your data on the Security and trust page.