Responsible disclosure

If you find a security problem in Fermium, tell us and we will fix it. This page is the policy that https://fermium.app/.well-known/security.txt points to.

In scope

• fermium.app, including the web app, the sign-in and OAuth endpoints, the /api endpoints and the SCIM endpoints.
• fermiumusercontent.app, the content host, including the sandbox, the viewer gate and the link resolver.
• The MCP server at https://fermium.app/mcp.
• A customer's custom domain, only with that customer's written consent. Without it, test against the shared hosts with your own workspace.

Use accounts and documents you created. A Free workspace is enough to test almost everything; if a finding needs a paid feature, email us and we will set up a test workspace.

Out of scope

• Denial of service, load testing, or anything that degrades the service for others, including automated scanning at a rate that does so.
• Social engineering of Fermium staff or customers, phishing, and physical attacks.
• Third-party services we use (Google sign-in, Stripe, Let's Encrypt) and issues in them; report those to the provider.
• Accessing, modifying or exfiltrating another customer's data beyond the minimum needed to demonstrate the issue. Prove that you can read one byte, not the whole document.
• Reports that only cite missing best-practice headers, version disclosure, or scanner output without a demonstrated impact.
• Rate limits, thresholds and lockout windows as such; report bypasses, not the values.

How to report

Email security@fermium.app. Include:

• what you found and why it matters;
• the exact steps to reproduce: URLs, request and response bodies, the account and document ids you used;
• what you were able to reach, and when you stopped;
• how you would like to be credited, or that you would rather not be.

Plain email is fine. We do not publish a PGP key at this time; if you need to send something encrypted, say so in a first message and we will arrange it.

What we commit to

• We acknowledge your report within 3 business days.
• We give you a status update within 10 business days, and keep you informed until the issue is resolved.
• We fix issues on a timeline set by severity: an issue that exposes customer data or lets an attacker act as another user is worked on immediately; lower-severity issues are scheduled and you will be told when.
• We tell you when the fix has shipped, and credit you by name or handle if you want that.
• We do not take legal action against research that follows this policy, and we will say so to a third party if you ask us to.

Safe harbor

Research conducted in good faith and within this policy is authorized. We will not pursue or support legal action against you for it, and we will not report it as a crime. If you reach personal data, another customer's documents, or credentials that are not yours, stop at once, do not copy anything further, and report immediately; tell us what you saw so we can assess it. Do not disclose the issue publicly until we have fixed it and agreed on a date with you.

If you are unsure whether something is covered, ask first at the same address.