Security and Vulnerability Disclosure
If you believe you have found a security weakness in CalculatorFox, please tell us before telling anyone else. Email security@calculatorfox.org with the steps to reproduce it. A machine-readable version of this policy is at /.well-known/security.txt.
What we ask
Give us a reasonable time to fix the problem before publishing it; do not access, change or delete data that is not yours; do not run denial-of-service, spam or social-engineering tests; stop as soon as you have enough evidence to demonstrate the issue.
What you can expect
An acknowledgement within three working days, an honest assessment, a fix as fast as the risk deserves, and credit here if you want it. We will not take legal action against research that follows this policy. We do not run a paid bug-bounty programme.
How the site is protected
All traffic is encrypted; saved calculations are encrypted at rest; passwords are stored as Argon2id hashes; sign-in, sign-up and contact forms are rate limited; every page carries a strict Content-Security-Policy; administrator actions are logged; dependencies are audited before each release.