Responsible Disclosure & Bug Bounty Program
- We take security seriously and deeply value the contributions of independent security researchers.
- Researchers acting in good faith under our Safe Harbor policy will not be subjected to legal action.
- Qualifying vulnerability reports should be reported directly to support@fomospills.in.
1. Safe Harbor Commitment
FOMO Spills values the security research community. If you conduct vulnerability research in good faith and in compliance with this policy, we commit to:
- We will consider your research authorized and will not pursue legal action against you under the Computer Fraud and Abuse Act (CFAA) or Indian Information Technology Act, 2000.
- We will work with you to understand and resolve the vulnerability promptly.
- We will publicly recognize your contribution in our Security Hall of Fame (unless you request anonymity).
2. Program Scope
In-Scope Targets include:
• https://fomospills.com (and all official subdomains)
• https://fomospills.in (and all official subdomains)
• SpillHub core API endpoints and Supabase authentication middleware
Out-of-Scope Targets:
• Denial of Service (DoS/DDoS) attacks against our edge CDN or database infrastructure
• Social engineering or phishing attempts against FOMO Spills staff or moderators
• Physical security attacks against data center facilities
• Automated vulnerability scanner reports without a verified proof-of-concept
3. How to Report a Vulnerability
To report a security vulnerability, please email support@fomospills.in with 'Vulnerability Report' in the subject line.
Include a detailed technical description of the vulnerability, reproduction steps, proof-of-concept payloads, and the affected endpoint.
Our security engineering team acknowledges reports within 24 hours and provides regular status updates until remediation is complete.
If you have questions regarding this policy, need clarification on creator terms, or wish to exercise data subject rights under GDPR, CCPA/CPRA, or India's DPDP Act, contact our legal and privacy team at support@fomospills.in.