Future Philosophy未来哲学

SECURITY

Security & Vulnerability Reporting

Version 1.2 · Updated 2026-11-08 · Effective from the date of publication on this website

This English version is provided for convenience. If it differs from the Chinese version, the Chinese version prevails.

Our service currently never asks you for any account password, verification code or payment

Future Philosophy has no payment features. Passwords and verification codes are entered only on this website's sign-in and registration pages or in the official app, and our staff will never ask you for them for any reason. Any web page, email, text message or phone call that claims to be Future Philosophy and asks you for a password, verification code, money transfer or personal ID documents does not come from us.

1. Identifying official access points

  • Official website: https://futurephilosophy.wiki (and https://www.futurephilosophy.wiki); the address bar of your browser should show a valid HTTPS connection;
  • Compatibility access point: https://124.223.55.2, used only for connections from early versions of the app;
  • Android app: named 未来哲学 (Future Philosophy), package name com.futurephilosophy.app; please get it from the app page on this website or from the app stores we have announced.

2. Security measures we take

  • HTTPS encrypted transmission is enforced across the entire site; the app trusts only system certificates and refuses plaintext connections;
  • Public content is served read-only, and content-writing and administration interfaces are disabled in the public version; the account interface offers only sign-in and account security functions, passwords are stored only as irreversible hashes, and sign-in attempts are rate-limited;
  • Service programs run under least-privilege accounts, with system-level sandbox isolation enabled;
  • Releases use canary verification and automatic rollback; the database is backed up online every day, and restores are rehearsed regularly;
  • Certificate validity and critical tasks are monitored continuously, with alerts when anything goes wrong;
  • No third-party analytics, advertising or tracking scripts are loaded on our web pages.

3. Reporting a security vulnerability

If you find a security vulnerability in this website or the app, please email service@deffuture.com and include as much of the following as possible:

  • The affected URL, interface or app version;
  • Steps to reproduce, the conditions required and how to verify the issue (screenshots or a screen recording);
  • Your assessment of the scope of impact and the severity;
  • Your contact details, and whether you would like to be credited after the fix.

Machine-readable contact information is available at /.well-known/security.txt.

4. Testing rules

To protect users and the service, please follow these rules when testing and reporting:

  • Comply with laws and regulations such as the Cybersecurity Law and the Provisions on the Management of Security Vulnerabilities in Network Products;
  • Verify only the minimum scope needed to show that the vulnerability exists, and do not access, download, modify or delete the data of others;
  • Do not carry out denial-of-service attacks, large-scale automated scanning, social engineering or physical attacks;
  • Do not plant backdoors on servers, maintain persistent access or move laterally;
  • Do not disclose vulnerability details publicly or to any third party until we have fixed the vulnerability and given our consent.

For researchers who follow the rules above and report vulnerabilities in good faith, we will not pursue legal liability, and we take every report seriously.

5. How we handle reports

  1. We acknowledge receipt of the report within 5 working days and let you know our initial assessment;
  2. We verify the vulnerability, assess its impact and schedule a fix; high-risk issues are handled first;
  3. Once the fix is live, we notify the reporter and, with their consent, can credit them by name in our acknowledgments;
  4. If the vulnerability involves a personal information security incident, we notify the affected users and report to the competent authorities, as committed in our Privacy Policy.
Operator
Nanjing Define Future Technology Co., Ltd.
Contact email
service@deffuture.com