Security

FutraDay aims to operate its public website and software products with practical security controls appropriate to their purpose.

Public website controls

The FutraDay site uses HTTPS, restrictive browser security headers and a limited analytics configuration. Public product sites may use additional controls relevant to their own architecture.

Reporting a security issue

If you believe you have found a security issue affecting FutraDay or one of its products, send a concise description, affected URL and reproduction details to hello@futraday.com.au. Please avoid accessing or modifying data that does not belong to you.

Security boundaries

The public FutraDay website is separate from the individual software products linked from it. Each product can have different authentication, data, hosting and integration requirements, so controls are applied according to the system being operated rather than treating every product as identical.

Responsible reporting

When reporting a suspected issue, include the affected URL, the behaviour you observed, clear reproduction steps and the security impact you believe is possible. Do not include real customer data, credentials or secrets in a report. Avoid destructive testing, denial-of-service activity, social engineering and attempts to access data that is not yours.

Operational practices

FutraDay uses HTTPS for the public site, restrictive browser headers and limited third-party browser integrations. Application changes are tested before production deployment where practical, and public-facing software is maintained with attention to authentication boundaries, input handling, dependency risk and safe external requests where those concerns apply.

What not to send

Never email passwords, private keys, API tokens, recovery codes or payment-card details. If sensitive evidence is genuinely required to understand a report, first describe the issue without the secret material so an appropriate way to continue can be agreed.

Scope

This page is a security contact and practice summary, not a certification or guarantee that every system is free from vulnerabilities.