Security

How to report a vulnerability on this site, what to include, what to expect from us and what we do to protect your data.

In 30 seconds

  • If you found a flaw

    Write to legal@falcani.com with what you saw and how to repeat it. We read it, fix it and, if you want, tell you when it is resolved.

  • How to act

    Test only what is yours, do not access other people’s data, do not overload the site and give us time to fix it before you talk about it in public. If you act in good faith, we will take no legal action against you.

  • Where the contact is

    The security.txt file, at the standard address /.well-known/security.txt, carries the contact and the date until which it is valid, so tools and researchers find it on their own.

  • What we do

    Encrypted connections, validation on the server, verification against automated programs and a limit on sends. We store no passwords or payments: the site has no accounts.

Prepare your report

Fill in what you know. We put together the text of the email; nothing is sent from here.

Your email

To
legal@falcani.com
Subject
Security report

Where: (left blank) Steps to repeat it: (left blank) Impact: (left blank)

Open in my email

How a tool sees it

Reading the file...
Open security.txt

Full text

1. How to report a vulnerability

If you believe you found a security flaw on this site, write to us at legal@falcani.com. The same contact is in the security.txt file, which follows the RFC 9116 standard and offers it at a fixed address so any tool can find it.

So that we can act quickly, include:

  1. What you saw and on which page or route.
  2. The steps to repeat it.
  3. What impact you think it has.
  4. How we can contact you, if you want an answer.

2. What to expect from us

  • We will read your report and answer to confirm that we received it. We do not promise a deadline in hours.
  • We will review the flaw and fix it according to its severity.
  • If you want, we will tell you when it is resolved and, if you wish, we will credit your contribution.

3. Good-faith rules

To keep your research safe for everyone, we ask that you:

  • Test only with your own data and do not access, change or delete other people’s data.
  • Not run tests that overload the site or denial of service attacks.
  • Not use social engineering or phishing against the team or other people.
  • Give us a reasonable time to fix the flaw before disclosing it.

If you act in good faith and under these rules, we will take no legal action against you for your research.

4. What is in and out of scope

In scope are this site and its API routes. Out of scope are the third-party services it uses (Clientary, ZeptoMail, Cloudflare, Vercel and Upstash): report those to their owners. Issues with no security impact, such as a missing header with no practical effect, and automated scanner reports without proof of impact are not vulnerabilities either.

5. What we do to protect your data

  • Connections to the site use HTTPS.
  • The forms validate everything they receive on the server.
  • Cloudflare Turnstile verifies that whoever sends is a person.
  • A limit on sends per visitor curbs abuse; to count them we use an identifier derived from the IP, never the IP itself.
  • The site has no accounts or passwords and processes no payments.

Pending review

This text is a draft. We still need to confirm: that legal@falcani.com is the mailbox for security reports or open a dedicated one, whether falcani will offer credit or rewards, and the expiry date of the security.txt file, which must be renewed before it arrives.