fennec is built and maintained by Singularity RD. If you find a vulnerability in fennec itself, we want to hear about it and will work with you to fix it before details are made public.
Email security@singularityrd.com. Do not open a public issue. Include the affected version (fennec --version), your platform, the impact, and steps to reproduce. If you need to send sensitive material, say so and we will arrange an encrypted channel. English or Turkish is fine.
| Acknowledgement of your report | 2 business days |
| Initial assessment and severity | 5 business days |
| Fix or mitigation for critical and high issues | 30 days |
| Fix or mitigation for medium and low issues | Next scheduled release |
We keep you informed while we work, and with your permission credit you in the release notes.
Please give us 90 days from your report to release a fix before disclosing details. If a fix ships sooner, we will agree a disclosure date with you. If an issue is being actively exploited, we may publish an advisory earlier.
The latest minor release is supported. The previous minor release receives security fixes for 90 days after the next minor release ships. Enterprise customers receive fixes according to their agreement.
In scope:
license.fennec.singularityrd.com and this websiteOut of scope:
We will not pursue legal action against good-faith research that follows this policy, avoids privacy violations and service disruption, and does not access or modify data that is not yours.
Machine-readable version: /.well-known/security.txt