Droidify is a read-only web application. It fetches public data from third-party sources, renders HTML pages, and stores a minimal amount of data for people who choose to sign in. No payments. No file uploads. No private data beyond a GitHub username and a watchlist.
- FastAPI route vulnerabilities — injection, path traversal, SSRF
- Auth or session issues — login bypass, accessing another user's watchlist
- Data exposure — any user data visible to someone who should not see it
- SSRF in scrapers — a scraper being manipulated into fetching internal addresses
- Dependency CVEs with a realistic exploit path on this specific stack
- Inaccurate data from upstream sources — wrong ROM version is a data issue, not a security vulnerability
- Content of download links hosted by third parties — we link to them, we do not control them
- Social engineering scenarios
- Generic observations with no demonstrated impact
Open a GitHub issue. If the details should not be public yet, describe the category without the full exploit and we will follow up privately.
Tell us:
- What the vulnerability is
- How to reproduce it
- What an attacker could actually do with it
Do not disclose publicly before a fix is deployed. We will move as fast as we can.
No bug bounty. We will credit you in the commit if you want.
Never signed in — nothing. No analytics. No cookies. No fingerprinting. No tracking. Not even a page view counter.
Signed in with GitHub:
- Your GitHub username, avatar URL, and numeric ID
- Your watchlist — up to 20 device codenames
- One signed session cookie expiring after 30 days
The session cookie is httponly (JavaScript cannot read it), samesite=lax (cannot be sent cross-site), and signed server-side (cannot be forged).
We do not store passwords, email addresses, IP addresses, location data, or any record of what pages you visited or when.