Security

Email contact@spyxpo.com with enough detail to reproduce the issue — the affected URL or endpoint, the steps, and what an attacker gains. Screenshots and a proof-of-concept help. Machine-readable contact details are at /.well-known/security.txt.

• Acknowledgement: within 3 business days.
• Triage and severity: within 10 business days.
• Fix or timeline: within 30 days for confirmed issues.

We do not currently run a paid bug-bounty programme. We will credit you publicly on this page if you want the attribution.

If you make a good-faith effort to follow this policy, we will treat your research as authorised, will not pursue or support legal action against you, and will work with you to understand and resolve the issue quickly.

Good faith means, at minimum:

• Test only against accounts you own or have explicit permission to use.
• Stop as soon as you have confirmed a vulnerability. Do not pivot, escalate, or enumerate other users' data.
• Do not run denial-of-service, spam, social engineering, or physical attacks against us, our staff, or our vendors.
• Do not exfiltrate, retain, or publish personal data. If you encounter it, stop and tell us.
• Give us reasonable time to remediate before public disclosure.

In scope:

• spyxpo.com and its subdomains.
• Our Cloud Functions API endpoints.
• Firestore and Cloud Storage security-rule bypasses.
• Our published applications and downloads.

Out of scope:

• Vulnerabilities in third-party platforms themselves (Google Cloud, Firebase, Razorpay) — report those to the vendor.
• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers or best-practice warnings without a working exploit.
• Social engineering, phishing of staff, and physical security.
• Rate-limiting or brute-force reports without a bypass of an actual control.

• Encryption in transit. HTTPS is enforced site-wide with HSTS, including subdomains.
• Encryption at rest. Data is stored in Google Cloud (Firestore and Cloud Storage), encrypted at rest by the platform.
• Authentication. Firebase Authentication with mandatory email verification before an account can transact.
• Authorisation. Every read and write is mediated by Firestore and Storage security rules with role-based checks. These rules have their own automated test suite, run against the emulator.
• Payments. Card data never touches our servers. Payments are processed by Razorpay, a PCI-DSS-compliant gateway; we store only the resulting order and payment identifiers.
• Least privilege. Administrative surfaces are gated behind explicit roles rather than a shared login.
• Secrets. Server-side secrets live in Firebase Secret Manager and functions environment configuration, never in the client bundle or the repository.

Stating this plainly is more useful to you than a badge wall. As of the review date above:

• We hold no SOC 2, ISO 27001, or equivalent third-party certification, and we do not claim compliance with any.
• We have not commissioned an independent third-party penetration test.
• The site does not yet send a Content-Security-Policy header. It is a static export whose inline theme and structured-data scripts would require per-request nonces to lock down properly; a refactor to external scripts is the prerequisite.
• We do not operate a formal 24/7 security on-call rotation. Reports are handled during Indian business hours.

If a breach affects your personal data we will notify you and the Data Protection Board of India as required under the DPDP Act 2023. Service disruptions and their post-mortems are published on the status page.

What we collect and why is set out in the Privacy Policy. Optional analytics and diagnostics are off until you turn them on — manage that under privacy choices.