Security Vulnerability Reporting

Before you start

We take the security of the ByFuns website and public APIs seriously. If you are a security researcher or simply noticed a security problem on this site, we would love to hear from you.

This page is our disclosure entry point. A machine-readable record is also available at security.txt.

In scope

• Website pages and client-side logic under www.byfuns.top and its subdomains
• Public API endpoints (NetEase Cloud Music parsing, public IP lookup, etc.)
• Server, configuration, TLS, authentication and access-control weaknesses

Out of scope: vulnerabilities in third-party services, resource-exhaustion issues that require heavy traffic or stress testing, and issues that only affect your own local environment.

How to report

Send an email to:

Use the prefix [Security] in the subject, and encrypt or de-identify sensitive data where possible.

What to include

1. Location: the exact URL, endpoint or parameter affected
2. Reproduction steps that are clear and repeatable
3. Impact: what data is exposed or modified, and how far it can be chained
4. Evidence: request/response samples, screenshots or a minimal PoC
5. Your nickname and contact details for follow-up and credit

Response times

• Within 24 hours: we acknowledge your report
• Within 7 business days: we finish triage and confirm whether it is accepted
• After the fix: we credit you on this page if you agree

Duplicates or out-of-scope reports will also receive a short explanation.

Our commitment

For good-faith research that follows the rules on this page, we will not pursue legal action and will not block or ban you; we will work with you to verify and fix the issue. Please keep details private until a fix is available, and never read, modify or delete other users' data.

Please do not

• Perform denial-of-service, stress or high-volume concurrent testing
• Plant backdoors, trojans, web shells or any malicious file
• Bulk-download, alter or delete user data and site files
• Use social engineering, phishing or harassment
• Publish or sell vulnerability details without permission

Known issues

Some historical issues are listed on the known issues page for reference only; the list is incomplete and does not reflect the current state.