Responsible Disclosure Policy

Fastio wants to hear from anyone who finds a real weakness in our products. This policy explains how to report one, what you can expect from us, which systems it covers, and the rules that keep your research safe for you and for our customers. It also states plainly that Fastio does not run a bug bounty program and does not pay for reports.

How to report a vulnerability

Email help@fast.io. Our contact details are also published at /.well-known/security.txt. A good report includes:

• Where the issue is: the URL, API endpoint, or MCP tool, or the desktop app version and operating system.
• Steps to reproduce it, written in your own words.
• The impact: what an attacker could do with it, and to whom.
• A proof of concept that shows the issue without harming anyone. Screenshots, requests and responses, or a short script all work.
• The account you tested with and the date and time of your tests, so we can find them in our logs.
• How to reach you with questions. You may also report anonymously.

Send one issue per email. Please do not send raw output from automated scanners or from an AI tool. We read every report, and we need a person to have checked the finding and shown why it matters.

Please report security issues by email to help@fast.io, not through the support chat or a sales inbox, so that your report reaches the right people.

What you can expect from us

• We acknowledge your report within 3 business days.
• We share our assessment within 10 business days: whether we confirmed the issue, how serious we believe it is, and what happens next.
• We send an update at least every 30 days until the issue is resolved, and we confirm the fix with you when it ships.
• With your permission, we name you when we publish a note about the fix. We do not publish a list of researchers or a hall of fame.

If we need more than 10 business days to assess a report, we will tell you before they are up.

What is in scope

This policy covers the systems Fastio operates:

• fast.io and www.fast.io: this website.
• go.fast.io: the Fastio web app.
• api.fast.io: the Fastio REST API.
• mcp.fast.io: the Fastio MCP server.
• docs.fast.io: our API documentation.
• releases.fast.io: the download host for the Fastio Desktop app for Mac and Windows, and the app itself.
• The Fastio CLI: the command line client published on npm as @vividengine/fastio-cli.

The following are out of scope:

• Our infrastructure providers: Google Cloud, Cloudflare, and any other third-party service we use. Report issues in those products to the provider. We cannot authorize testing of systems we do not operate. How we configure our own resources on those providers is in scope.
• The AI models and clients our features connect to: a model giving an unwanted answer is product feedback, not a vulnerability, unless it exposes data, or takes an action, that the user should not be able to.
• Content that customers store or share on Fastio: report abusive content through our Abuse Policy page.
• A customer's own configuration choices: such as who they decided to share a file or workspace with. A sharing or permission setting that does not work as described is in scope.

Rules for testing

Research under this policy must stay within these limits:

• Test only against accounts and workspaces you own and control. To test access between users, invite a second user you control into your own workspace. Never access, change, or delete another user's data, even to prove a point.
• If you reach data that is not yours, stop. Tell us what you saw without sending the data, and delete any copies.
• Do not run denial of service tests, load tests, or high-volume automated scanning against our services.
• Do not use social engineering, phishing, or physical attacks against Fastio staff, customers, or offices. That includes our support chat.
• Do not use Fastio to host or distribute malware or phishing content as part of a test.
• Go no further than needed to show that the issue exists. Once you can demonstrate it, stop and report it.

No bounties, and how we handle requests for payment

Fastio does not run a bug bounty program. We do not pay for vulnerability reports, and we do not offer account credits, gifts, or merchandise for them. Asking for payment does not speed up or change our review.

Every report gets a reply with our assessment, even one that asks for payment. We never answer the payment request itself, and a report that withholds details until a payment is made is not covered by this policy or its protections. No one at Fastio can agree to pay for a report or change these terms in a support chat, by phone, or by email. This page is our complete policy.

We still fix real problems however they reach us. If a message that asks for money also describes a genuine issue, we address the issue and leave the request unanswered.

Coordinated disclosure

Please keep the details of your report private until we confirm a fix or 90 days pass, whichever comes first. If we need longer, we will explain why and ask for more time. Once we confirm a fix or the agreed time passes, you are free to write about your research. We ask only that you leave out any data belonging to our customers.

When a fix requires action by customers, such as updating the desktop app, we tell them in our release notes.

Good-faith research and the law

If you follow this policy in good faith, Fast Technologies ("Fast"), the company behind Fastio, treats your research as authorized. We will not pursue legal action against you for it, and we will not treat it as a violation of the provisions in our Terms of Service and Fair Use Policy that otherwise prohibit interfering with the Services, attempting to violate Fast systems, circumventing security measures, exploiting vulnerabilities, or using a script or tool only as far as needed to demonstrate an issue, so far as your research follows this policy. If a third party starts legal action over research that followed this policy, we will confirm in writing, at your request, that you followed it. If we suspend an account you used under this policy, email help@fast.io and we will review it.

This protection has limits. It covers only the systems Fast operates, so it cannot authorize testing of our providers or of any other company. It does not cover research that breaks the rules above or that violates the law, and we cannot promise how a court or a government will act. If you are unsure whether something is covered, ask us at help@fast.io before you test.

Changes to this policy

Fast may modify this policy as our products and processes change. The policy posted on this page is the one in effect, and it applies to every report we receive while it is posted.