Security Policy

We take security seriously. If you discover a vulnerability, we want to hear about it.

Responsible Disclosure

If you believe you have found a security vulnerability in PasteFox, please report it to us responsibly. Do not disclose the vulnerability publicly until we have had a chance to address it.

[email protected][email protected]

Responsible Party

PasteFox — Jonas Dahle

c/o Online-Impressum.de #506

Europaring 90

53757 Sankt Augustin, Germany

Email: [email protected]

What you may test

Cross-Site Scripting (XSS) in paste content, titles, or user inputs

Cross-Site Request Forgery (CSRF) on state-changing actions

Injection vulnerabilities (SQL, NoSQL, command injection)

Authentication and session management flaws

Insecure Direct Object References (IDOR) — accessing other users' data

API authentication bypass or privilege escalation

Information disclosure through error messages or debug endpoints

Rate limiting bypass on authentication or API endpoints

Broken access control on private or password-protected pastes

What is NOT allowed

Denial of Service (DoS/DDoS) attacks or any form of service disruption

Automated scanning with aggressive tools (Nessus, Burp Suite active scan, etc.) without prior approval

Social engineering attacks against PasteFox staff or users

Physical attacks against PasteFox infrastructure

Accessing, modifying, or deleting data belonging to other users

Spamming, phishing, or sending unsolicited messages through the platform

Uploading malware, ransomware, or any malicious payloads

Testing on production accounts other than your own

Any activity that violates applicable laws

How to report

When reporting a vulnerability, please include as much detail as possible:

1.Description of the vulnerability and its potential impact

2.Step-by-step instructions to reproduce the issue

3.Affected URL, endpoint, or component

4.Screenshots or proof-of-concept (if applicable)

5.Your suggested fix or mitigation (optional)

6.Your contact information for follow-up

Response timeline

24 hoursWe acknowledge receipt of your report

72 hoursWe provide an initial assessment and severity rating

7 daysWe aim to have a fix in progress for confirmed vulnerabilities

30 daysWe aim to have the fix deployed and will notify you

Safe harbor

We will not take legal action against security researchers who:

Act in good faith to avoid privacy violations and data loss

Only interact with accounts you own or with explicit permission

Do not exploit a vulnerability beyond what is necessary to confirm it

Report vulnerabilities promptly and do not disclose them publicly before a fix