Responsible Disclosure
If you’ve found a security issue on this website or its infrastructure, here’s how to report it.
Scope
This policy covers this website and the infrastructure it runs on. It does not cover any client system — those are governed by that client’s own disclosure policy, if they have one.
How to report
Use the contact form to describe what you found, the steps to reproduce it, and its potential impact. Proof of concept is welcome; a working exploit against production data is not necessary to make the point.
What to expect
- An acknowledgement of your report.
- Honest communication about whether and when it will be fixed.
- No legal action against good-faith research conducted under this policy.
- Credit in any public write-up, if you’d like it — or anonymity, if you’d rather.
Ground rules
Test only against this website — not against any service it links to. Don’t access, modify or exfiltrate data beyond what’s needed to demonstrate an issue. Stop and report as soon as you’ve confirmed a finding, rather than continuing to probe.
Out of scope
- Denial-of-service or load testing
- Social engineering or phishing
- Physical access attempts
- Automated scanning aggressive enough to degrade the site for other visitors