Security

• Every connection to FUNXTOURS is encrypted (HTTPS), and browsers are told to always use it.
• Signing in with a password also needs a 6-digit code sent to your email. Administrator accounts always need the code, even with Google, sign in for 12 hours at most, and are emailed every time they sign in.
• Passwords are stored only as Argon2id hashes, never as the password itself. After 5 wrong passwords, password sign-in to that account pauses for 15 minutes and the owner is emailed.
• Card payments are handled by Paystack. FUNXTOURS never sees or stores card numbers or CVV codes, and every payment is confirmed directly with Paystack before a booking is confirmed.
• Our database can only be reached by our own systems. It is backed up every day, the backups are encrypted, and each backup is test-restored automatically.
• Forms are protected against bots and repeated guessing, and important actions such as bookings, cancellations, listing approvals, account blocks and FunX Coins changes are recorded.
• Photos are cleaned before upload, removing hidden details such as the location where they were taken.
• Our code is checked automatically for known vulnerabilities and accidentally exposed secrets.

More about how we handle personal information is in our Privacy Policy.

• Reset your password straight away with "Forgot password" on the sign-in page. This signs out every other device.
• Tell us at info@funxtours.co.za or in the Contact FUNXTOURS chat, so we can check your account and bookings.
• FUNXTOURS will never ask for your password, sign-in code or card details by email, chat, phone or WhatsApp.

If you believe you have found a security problem on funxtours.co.za or our app, please tell us. Email info@funxtours.co.za with "Security report" in the subject, and include:

• what the problem is and where (the page or address)
• the steps to reproduce it, and what an attacker could do with it
• your name or handle, if you would like to be thanked

What we promise

• We will confirm we received your report within 3 business days.
• We will tell you what we found within 10 business days, and keep you updated until it is fixed.
• With your permission, we will thank you publicly once it is fixed.
• We will not take legal action against you for research that follows these rules in good faith.

Rules for testing

• Only test with your own accounts. Never access, change or delete other people's data. If you come across personal information by accident, stop, do not keep it, and tell us.
• Do not run denial-of-service attacks, heavy automated scanning, spam, or tests that could disrupt the site or bookings.
• Do not try to trick our staff, hosts or guests (no phishing or social engineering), and do not test physical security.
• Give us reasonable time to fix the problem (up to 90 days) before telling anyone else about it.

Usually out of scope

Reports from automated scanners without a demonstrated impact, missing best-practice headers with no real risk, problems that only affect your own account (such as self-XSS), and rate limits that only slow down sending lots of requests. FUNXTOURS does not currently pay rewards for reports.

If a security incident ever affects your personal information, we will tell you and the Information Regulator as soon as reasonably possible, as POPIA requires, and explain what happened and what you can do.