Security
If you think you have found a security problem in FamAntics, please tell us.
Report a vulnerability
Email [email protected]. Tell us what you found, how to reproduce it, and who it could affect.
- Please do not access, change or delete anyone else’s data while you look.
- Give us a reasonable time to fix the problem before you tell anyone else.
- We read every report and reply as soon as we can.
Machine-readable contact details are at /.well-known/security.txt.
How a fam is protected
- A closed fam. Only the members of a fam can see inside it, and each member chooses who sees each story they share. Being a steward gives no extra access to what others share.
- Sign-in without a password. You sign in with a one-time code sent to your email, through WorkOS, so there is no FamAntics password to steal or reuse.
- Photos and videos are private. They are kept in private storage with no public address. The app hands one out only after checking that you may see the story it belongs to.
- Staff cannot read fam content. DevPartners operators can help a fam, for example by appointing a steward when none is left, but they cannot read its stories or see its photos and videos. Every operator action is recorded.
- Nothing changes in secret. Every steward action is announced to the fam and kept in its history.
- Encrypted connections. Every page and every request uses HTTPS, and everything is encrypted on disk.