Security
If you think you have found a security problem in famsecrets, please tell us.
Report a vulnerability
Email security@famsecrets.com. Tell us what you found, how to reproduce it, and who it could affect.
- Please do not access, change or delete anyone else’s data while you look.
- Give us a reasonable time to fix the problem before you tell anyone else.
- We read every report and reply as soon as we can.
Machine-readable contact details are at /.well-known/security.txt.
How a fam is protected
- A closed fam. Only the members of a fam can see inside it, and each member chooses who sees each thing they share. Being a steward gives no extra access to what others share.
- Sign-in without a password. You sign in with a one-time code sent to your email, through WorkOS, so there is no famsecrets password to steal or reuse.
- Staff cannot read fam content. DevPartners operators can help a fam, for example by appointing a steward when none is left, but they cannot read what is inside it. Every operator action is recorded.
- Nothing changes in secret. Every steward action is announced to the fam and kept in its history.
- Encrypted connections. Every page and every request uses HTTPS.