Responsible Disclosure Policy
Feisty Fox Security Pty Ltd - PO Box 1214, Gungahlin ACT 2912, Australia - Last reviewed November 2026
A single, clear path for reporting a suspected vulnerability in our own services, with defined protections for researchers who follow it.
1. Purpose
Feisty Fox Security welcomes good-faith security research on our own public services. This policy explains how to report a suspected vulnerability, what we will do with the report, and the protections we extend to researchers who follow it.
2. How to report
Send findings to the Principal Architect through the encrypted comms console on our home page, or via the PGP fingerprint published there. Include the affected asset, a reproduction path, potential impact, and any proof-of-concept material. Encrypt sensitive detail where possible.
3. In scope
Only assets we explicitly own, such as feistyfoxsecurity.com and the AloupaAI platform endpoints we operate. Third-party services, client environments, and any system we do not own are strictly out of scope and must never be tested.
4. Our commitments
We will acknowledge a complete report within two business days, keep you informed of remediation progress, and not pursue legal action for research conducted in line with this policy. We will credit you if you wish and if the client or platform owner agrees.
5. Coordinated disclosure
We ask for 90 days from acknowledgement before public disclosure, or longer where a fix requires changes across client environments. We will agree a disclosure date with you in writing and will not disclose your identity without consent.
6. Prohibited conduct
No denial-of-service testing, no social engineering of our staff or clients, no access to, retention of, or disclosure of third-party data, no modification of production systems, and no use of automated scanning that degrades service. If you encounter client data, stop and report immediately.
Report through the encrypted comms console on our home page. Sensitive findings should be encrypted to our published PGP fingerprint.