Security

Reporting a vulnerability

Email security@funfriday.work with what you found, how to reproduce it and what you think the impact is. We acknowledge reports within three working days, keep you updated, and credit you once the fix ships if you’d like.

Please test only with your own accounts. Don’t access other people’s data, degrade the service, or point automated attack scanners at production. Good-faith research within these limits won’t be pursued.

Scope

funfriday.work and its subdomains, the Fun Friday apps for Slack, Discord, Google Meet and Zoom, and the Fun Friday MCP server. The services we build on (Supabase, Cloudflare, Azure, Zoom, Google) run their own programmes.

How we keep Fun Friday secure

• HTTPS everywhere, with HSTS; data encrypted in transit and at rest.
• Row-level security on every database table; secrets never in code.
• Every change reviewed and tested in CI before it ships, with automatic rollback.
• Daily encrypted backups; continuous monitoring and alerting.
• Regular dependency updates and security scans.
• We collect as little as we can — see the Privacy Policy.