Security at Firstory

Security contact

Eric Chen (陳昱澄) is the security lead at Firstory. The security lead owns product security for the Firstory platform and responds to vulnerability reports.

Email: firstory@firstory.me

Report a vulnerability

If you find a security vulnerability in Firstory, please tell us. Send an email to firstory@firstory.me. Include:

• The affected URL, app, or API endpoint.
• The steps to reproduce the issue.
• The impact that you expect.
• Your name or handle, if you want credit.

We send an acknowledgment within 30 business days. We tell you when we fix the issue.

Scope

In scope:

• Firstory Studio (studio.firstory.me)
• Firstory listener site (open.firstory.fm)
• Firstory creator sites (*.firstory.cc)

Out of scope:

• Third-party services that we use, such as payment and email providers. Report issues in these services to the provider.
• Denial-of-service attacks.
• Social engineering and phishing of Firstory staff or users.
• Physical attacks.

Rules for testing

• Use only accounts that you own, or accounts that you have permission to use.
• Do not access, change, or delete data that belongs to other users. If you see such data by accident, stop and tell us.
• Do not degrade the service for other users.
• Do not publish the issue before we fix it, or before 90 days pass from your report.

Rewards

We do not offer monetary rewards at this time. With your permission, we thank you by name when we fix the issue.