Security and Data Handling

Anonymous endpoints are bearer-secret URLs: anyone who knows the random URL can send requests to it and view its anonymous inbox. Account-owned endpoints require the owner or an invited teammate to view history, and API or CLI access to owned endpoints requires a scoped API key.

• TLS is required for the public service.
• API keys are stored as cryptographic hashes, shown only once, independently revocable, scope-limited, optionally expiring, and rate-limited.
• Platform and proxy credentials are removed from captured headers.
• Server-side replay blocks private, loopback, and metadata addresses.
• Server-side replay has a hard outbound request deadline.
• Oversized request bodies stop reading at the plan limit.
• Endpoint counts and anonymous endpoint creation are rate-limited.
• Expired endpoints and old request data are removed automatically.

Treat endpoint URLs and share links like passwords. Use account-owned endpoints for private work, rotate endpoints after accidental disclosure, verify provider signatures in your application, and avoid sending production secrets or regulated data to testing tools.

Send suspected vulnerabilities to security@relayfox.dev. Include reproduction steps and potential impact. Do not access other users' data, run denial-of-service tests, or publish an unresolved issue. Good-faith reports will be investigated promptly.

RelayFox investigates credible reports, contains affected systems, rotates exposed credentials where applicable, removes unsafe data, and communicates material incidents to affected users when contact information is available.