Effective 29 October 2026
If you believe you have found a security problem in FrameDecks, we want to hear from you, and we will work with you to fix it.
How to report
Write to [email protected] with:
- what you found, and what someone could do with it;
- the steps to reproduce it (the version of the program, the page or address, what you sent);
- your name or handle if you would like to be thanked.
Please do not include real people's personal data in a report. If you need to send something sensitive, say so and we will agree a safer way.
What we promise
- We reply within 3 working days to confirm we have your report.
- We keep you informed, and aim to fix serious problems within 30 days and others within 90 days.
- We credit you on the Security page if you wish, once it is fixed.
- We will not take legal action, or ask anyone else to, against research done in good faith under this policy.
Please
- Only test against your own account, workspace and PC, or ones you have permission to use.
- Do not access, change or delete other people's data; stop and tell us if you reach any.
- Do not run denial-of-service tests, spam, social engineering, or physical attacks.
- Give us reasonable time to fix a problem before telling anyone else.
In scope
framedecks.com, api.framedecks.com, downloads.framedecks.com, the FrameDecks program for Windows (version 7.0 and later) and its update process, and the FrameRelay virtual camera.
Out of scope
Reports from automated scanners without a demonstrated problem; missing headers with no real impact; problems in third-party services (Supabase, Cloudflare, Google, Microsoft), which should go to them; and issues that need a PC that is already compromised.
Thank you for helping keep the people who use FrameDecks safe.