# Security | FYRHost

> How to disclose FYRHost infrastructure vulnerabilities responsibly. No ID at signup. Crypto-only billing. 40 locations. ECC memory, NVMe disks. DDoS filtering.

Source: https://fyrhost.com/security/

# Security

Mail vulnerabilities to security@fyrhost.com. Keep the testing to our own surface: no probing other tenants' VMs, no denial-of-service fire at the edge, no social engineering of staff.

The machine-readable policy lives at [/.well-known/security.txt](https://fyrhost.com/.well-known/security.txt).

## Verify us

Trust is checked, not requested. Three public artifacts let you audit our posture without writing to anyone:

- [Warrant canary](https://fyrhost.com/warrant-canary/) — a dated record that no warrants, gag orders or seizures have landed. A stalled update is the tell.

- [Status log](https://fyrhost.com/status/) — incidents with dates, appended only when an incident happens.

- [Looking glass](https://fyrhost.com/looking-glass/) — indicative RTT from every facility, so network claims are auditable.

Encrypted mail: ask for our PGP public key at security@fyrhost.com and confirm the fingerprint over a second channel before use. Support tickets live in the [client panel](https://fyrhost.com/panel/).