Security

How to report

Email security@frogpilot.com, or report it privately on GitHub through FrogPilot’s security advisories. Please don’t report security problems in public GitHub issues, on Discord, or anywhere else public.

If you spot personal data FrogPilot sends but doesn’t need, email privacy@frogpilot.com, and send security problems to security@frogpilot.com.

What to include

• What’s affected, such as frogpilot.com, api.frogpilot.com, or the FrogPilot software, with the branch and commit.
• Steps to reproduce the problem, and a proof of concept if you have one.
• What an attacker could do with it.
• How to reach you, and whether and how you’d like to be credited.

Please leave out other people’s personal data, and keep any data you send to the minimum needed to show the problem.

What we’ll do

• We’ll confirm we got your report, aiming to within 7 days.
• We’ll look into it, keep you updated, and tell you when it’s fixed.
• We’ll fix confirmed problems as quickly as we can, putting the ones that could affect driving or personal data first.
• Once it’s fixed, we’ll credit you if you’d like.

FrogPilot is a hobby project, so we can’t offer payment for reports.

Safe harbor

If you research and report a security problem in good faith and follow this page, we’ll consider your research authorized, we won’t take or support legal action against you for it, and if anyone else does, we’ll make it clear that you followed this page. Good faith means you

• avoid harming people, privacy, data, and the services, and stop as soon as you’ve shown the problem,
• give us reasonable time to fix the problem before you tell anyone else about it,
• never test anything in a way that could affect a car being driven, and only test FrogPilot itself on a parked car or on a bench, and
• only access the data you need to show the problem, and if you come across anyone else’s data, stop, don’t keep or share it, and tell us.

We can only authorize research on systems we run. Other companies’ services follow their own rules.

Scope

In scope are frogpilot.com, api.frogpilot.com, and the FrogPilot software in the FrogAi/FrogPilot repository. These are out of scope.

• Denial-of-service attacks, load testing, or anything that degrades the services for others.
• Physical attacks on people, cars, devices, or property.
• Services run by others, such as comma, Konik, Cloudflare, Vercel, Supabase, Backblaze, Sentry, GitHub, and Discord. Please report problems in those to them.
• Social engineering or phishing of anyone, including FrogPilot users and contributors.

How FrogPilot protects data

Here’s what FrogPilot’s code does today to protect data. Our privacy policy has the details.

• Devices sign in with their own key, and our server stores sign-in tokens only in hashed form.
• Driving logs are filtered on your device before upload, removing camera footage, audio, exact GPS coordinates, and the VIN field, among other things. Your car’s raw CAN bus messages stay in the logs.
• Server logs keep IP addresses only in hashed form.
• Server logs, abuse-prevention records, and issue reports are deleted within 90 days.
• The website and the device services use HTTPS.
• The website counts views with hashed codes instead of IP addresses, and deletes them within two days.
• Weather locations are rounded to about 1 km before they leave your device, and aren’t stored. Usage stats only include your nearest large city, worked out on your device.

The Pond, FrogPilot’s on-device web app, is open to anyone on the same Wi-Fi or Tailscale network unless you turn on “Pairing Code” in the Navigation settings, and it’s off by default. Without it, anyone on that network can see your device’s last position, favorites, saved keys, drives, camera footage, logs, and settings, and use controls such as door commands and backups. With it on, each browser needs the code shown on your device before it can use The Pond.

FrogPilot is a hobby project without a security team or an outside security audit, and no system is perfectly secure. That’s why your reports matter.