Vulnerability Disclosure Policy

Last updated: 12 October 2026.

Keeping our users safe matters to us, and many of them trust us with sensitive information. If you believe you have found a security vulnerability in EscortFox, we want to hear about it and will work with you to fix it. This policy explains what to test, how to report, and what you can expect from us.

Scope

In scope:

• escortfox.com, including every language version (for example escortfox.com/de);
• api.escortfox.com, the API used by the website and the installable web app.

Out of scope:

• services run by third parties, such as our content-delivery, e-mail, SMS-verification and payment providers. Report those to the provider directly;
• denial-of-service, load or stress testing, and any testing that degrades the service for others;
• social engineering of our staff or users, phishing, and physical attacks;
• reports from automated scanners without a demonstrated impact, missing best-practice headers without an exploit, self-XSS, clickjacking on pages without sensitive actions, and rate limits on non-sensitive endpoints;
• the content of listings. To report illegal, stolen or non-consensual content, use the content removal form instead.

Rules of engagement

• Test only against accounts you own or have the account holder's explicit permission to use.
• Access no more data than you need to demonstrate the issue. If you come across another person's personal data, including messages, photos, phone numbers or e-mail addresses, stop, do not save or share it, and tell us in your report.
• Do not modify or delete data you do not own, and do not contact our users or advertisers.
• Keep automated requests to a gentle rate.
• Give us a reasonable time to fix the issue before you disclose it publicly (see below).

How to report

E-mail [email protected] with "Security report" in the subject. Please include:

• the affected URL or API endpoint;
• a description of the vulnerability and its impact;
• step-by-step instructions to reproduce it, with proof-of-concept code or screenshots where helpful;
• how you would like to be credited, if at all.

Reports in English are preferred. You may report anonymously.

What you can expect from us

• We will acknowledge your report within 5 business days.
• We will confirm whether we can reproduce the issue and keep you informed of our progress.
• We aim to fix confirmed vulnerabilities within 90 days and will agree a disclosure date with you. If we need longer, we will explain why.
• With your permission, we will credit you once the issue is fixed.

We do not run a paid bug bounty programme and do not offer financial rewards.

Safe harbour

If you make a good-faith effort to follow this policy, we consider your research authorised. We will not pursue or support legal action against you for it, including under anti-hacking laws or our Terms of Use, and if a third party takes legal action against you over activity that complied with this policy, we will make clear that it was authorised. If in doubt whether something is in scope, ask us first.

Our machine-readable contact details are published in security.txt.