Security Policy

Reporting a vulnerability

If you discover a security vulnerability affecting few.bio, please report it privately by emailing [email protected].

Please include:

• A clear description of the vulnerability
• Steps to reproduce the issue
• The affected page, endpoint, or feature
• The potential security impact
• Any supporting screenshots or proof-of-concept material

Responsible disclosure

Please do not publicly disclose the vulnerability before we have had a reasonable opportunity to investigate and address it. Do not access, modify, download, or delete data belonging to other users.

Bug bounties

Depending on the severity and impact of the vulnerability, Encoded Software may offer a monetary bug bounty. Bounty eligibility and payment amounts are determined at our discretion. Submitting a report does not guarantee payment.

Security Researcher badge

Every valid vulnerability report that is successfully confirmed by our team earns the reporter the Security Researcher badge on few.bio.

Duplicate reports, previously known issues, reports without a reproducible security impact, and issues that do not represent a security vulnerability may not qualify.

Safe harbor

We will not pursue legal action against researchers who act in good faith, comply with this policy, avoid privacy violations and service disruption, and give us a reasonable opportunity to resolve the reported issue.