Security
Security and disclosure.
How Fydell protects Engineering Passport projects and share links, what Builder Reports and Simulations never claim, and how to report a vulnerability. Check how code is handled, and see what is and is not certified.
Effective 17 October 2026.
- Vulnerability reportsAcknowledged in three working days
- Repository codeRead as data, never run
- Two-step sign-inBefore sharing or publishing
- Share linksHashed, expiring, revocable
- Rate limitsSign-in, shares, analysis
- Staff accessTwo-step and audit log
On this page
Jump to what you need.
Reporting a vulnerability
Tell us what you found.
Email the security address below with what you found, how to reproduce it, and what it lets someone do. We reply from the same address.
We acknowledge reports within three working days, keep you told about the fix, and credit you when it ships if you want credit.
- Send to
- security@fydell.com
- Include
- What you found, how to reproduce it, and what it lets someone do.
- Acknowledged
- Within three working days.
- Credit
- When the fix ships, if you want credit.
- Bounty
- Fydell does not offer a paid bug bounty at this time.
Safe harbour
Good-faith research is authorised.
Good-faith research that follows this policy is authorised. We will not pursue legal action or ask anyone else to.
How to test
- Use only accounts you own or have permission to use.
- Stop at the minimum needed to show the issue.
- Do not access or keep other people's data.
- Do not degrade the service.
- Give us reasonable time to fix the issue before telling others.
Out of scope
- Denial of service, spam, social engineering of staff or users, and physical attacks.
- Findings from automated scanners without a demonstrated impact.
- Missing headers or best practices with no exploitable effect.
- Third-party services Fydell uses; report those to the provider.
How engineers' code is handled
Code is read as data, never run.
Repository code is read as data and never run. Analysis takes place in memory; paths that point outside the project, symlinks, submodules and oversized or compressed-bomb files are not read, and a hostile-repository test checks this on every change.
Files that look like credentials are skipped, and secrets found in code are redacted before anything is stored or sent to a model.
Code reaches a model provider only for repositories where the engineer turned model review on.
- Project filesRead as data
- Outside paths, symlinks, submodulesNot read
- Oversized and compressed-bomb filesNot read
- Files that look like credentialsSkipped
- Secrets found in codeRedacted before storage
- Model reviewOnly if the engineer turned it on
Accounts and sharing
Sharing is gated and revocable.
Engineers need two-step sign-in with an authenticator app, and a session that has entered a code, before creating share links or publishing.
Engineers get a notice in Fydell when a link is created and when someone opens one.
Unguessable links
Share links use 192-bit tokens stored only as hashes.
Every link expires
After 90 days unless the engineer chooses otherwise, and a link can be revoked at any time.
Rate limited
Sign-in, share creation and analysis are rate limited across all servers.
- Create or publishNeeds a two-step session
- Token192-bit, stored as a hash
- Expiry90 days by default
- RevokeAny time
- Notice to the engineerOn create and on open
Integrity signals
Labels with the observation behind them.
Fydell labels things a reviewer may want to ask about, such as one repository credited to several accounts, code matching another account's project, commits dated in the future, or most commits falling in one burst. These are labels with the observation behind them. They never lower a result, hide work or block an account.
Integrity signals never
- Lower a result.
- Hide work.
- Block an account.
Staff access
Admin actions are verified and recorded.
High-risk admin actions need two-step verification by default, and administrative actions are recorded in an audit log. Production data is read only to run and support the service.
- High-risk actionsTwo-step by default
- Administrative actionsRecorded in an audit log
- Production dataRead to run and support the service
Releases
Check what you download.
Direct Windows installers are not Authenticode code-signed yet. SmartScreen asks you to confirm the first launch; confirm only files from the Fydell download page. That page also shows each file's SHA-256 checksum so you can confirm what you received.
- Available
SHA-256 checksum for each installer
Shown on the Fydell download page so you can confirm what you received.
- Available
Signed desktop updates
Once installed, updates carry a signature the app verifies against Fydell's published key. A missing or wrong signature fails the update; it does not install the file.
- Backlog
Authenticode code signing for Windows installers
Not signed yet. SmartScreen asks you to confirm the first launch.
- Backlog
CLI checksum file
The CLI, once published, ships with a fydell.cjs.sha256 file beside it.
Certifications
No SOC 2 report yet.
Fydell is not SOC 2 certified. There is no SOC 2 report or third-party penetration test to share today. A SOC 2 audit is a later goal; this page will say so when one has been completed, and not before.
- Backlog
SOC 2 report
A later goal. This page will say so when an audit is complete.
- Backlog
Third-party penetration test
None to share today.
Product trust rules, including what Fydell does and does not claim, are stated in full on the Trust page. This page covers vulnerability disclosure and technical controls.
Found something? Tell us.
Report vulnerabilities to the security address. We acknowledge reports within three working days.