Security policy

I take the security of my systems seriously. Weaknesses can still slip through, so if you find one, I want to hear about it and fix it fast.

Scope

This coordinated vulnerability disclosure policy is not an invitation to scan or attack my systems. If you come across a vulnerability in one of them, report it using the guidelines below so I can fix it without putting data or third parties at risk.

What I ask of you

• +Email your findings to [email protected] and encrypt the message with my PGP key.
• +Include enough detail to reproduce the problem. The IP address or URL of the affected system and a description usually suffice. Complex issues may need more.
• -Don't exploit the vulnerability beyond what you need to demonstrate it. Don't download more data than necessary, and don't delete or change data that belongs to others.
• -Don't share the problem with others until I've fixed it.
• -Don't use physical attacks, social engineering, DDoS, spam or attacks on third-party applications.

What I promise in return

• +I'll reply within three business days with my assessment and an expected fix date.
• +If you follow the guidelines above, I won't take legal action against you over your report.
• +I'll treat your report as confidential and won't share your personal details with third parties without your permission.
• +I'll keep you updated on progress toward a fix.
• +I offer a small reward for every report of an issue I didn't know about.