Trust infrastructure

Security and responsible disclosure

Genealogy data can expose living relatives, private evidence, and family relationships. GeneaRoute treats a clear vulnerability-reporting path as part of the product, not a hidden support chore.

Customer controls

Secure HTTP-only sessions, authenticator MFA for paid checkout, one-time recovery codes, active-session revocation, hashed API keys, private-by-default workspaces, and explicit legal acceptance.

Research safeguards

Living-person privacy preflights, human-reviewed agent changes, evidence-linked claims, source-integrity checks, signed webhook bodies, and privacy-minimized optional AI processing.

Operational limits

No online service is risk-free. GeneaRoute documents controls accurately, monitors critical workflows, maintains tested backups, and asks researchers to report suspected failures promptly.

What to report

High-value security findings

Access to another customer’s account, private tree, evidence, files, or billing state
Authentication, MFA, session, API-key, review-link, or permission bypasses
Living-person information appearing in a public or unintended response
Webhook signature, source-fetching, upload, export, or payment-flow vulnerabilities

Testing boundaries

Keep research safe and proportionate

Use only accounts and data you own or have explicit permission to test.
Do not retrieve more data than needed to demonstrate the issue.
Do not disrupt availability, send spam, perform social engineering, or test physical security.
Do not publish private customer data. Give Flygon LC a reasonable opportunity to investigate before public disclosure.

Send a useful report

Include the affected address, steps, impact, and minimal evidence

Email genearoute@flygonlc.com. Remove unrelated personal data, credentials, and raw genealogy records. Flygon LC will acknowledge and investigate good-faith reports as practical. GeneaRoute does not currently operate a bug bounty, and this policy is not a promise of compensation or permission to violate law or third-party terms.

Automated discovery is also published at /.well-known/security.txt. Policy effective September 1, 2026.

High-value security findings

Access to another customer’s account, private tree, evidence, files, or billing state

Authentication, MFA, session, API-key, review-link, or permission bypasses

Living-person information appearing in a public or unintended response

Webhook signature, source-fetching, upload, export, or payment-flow vulnerabilities

Keep research safe and proportionate

Use only accounts and data you own or have explicit permission to test.

Do not retrieve more data than needed to demonstrate the issue.

Do not disrupt availability, send spam, perform social engineering, or test physical security.

Do not publish private customer data. Give Flygon LC a reasonable opportunity to investigate before public disclosure.

Include the affected address, steps, impact, and minimal evidence

Automated discovery is also published at /.well-known/security.txt. Policy effective September 1, 2026.