Security Policy

How to report #

Email [email protected]. For a problem in a code repository, you can also use the private vulnerability reporting of the platform it's hosted on, where it's enabled. Please don't open a public issue or pull request for a vulnerability until it's fixed.

Include:

• the affected service, page or repository, and the version or commit if you know it
• what the vulnerability is and what an attacker could do with it
• steps to reproduce it, with a proof of concept if you have one
• how you'd like to be credited, if at all

What's in scope #

In scope:

• services we run that link to this policy, as described in the privacy policy
• the latest version of code in our public repositories

Out of scope:

• copies of our code run by other people; report those to whoever runs them, and to us if the flaw is in the code itself
• third-party platforms and providers; use their own reporting programs
• services that have been discontinued, and old versions of code
• denial-of-service, spam, social engineering and physical attacks
• findings with no realistic security impact, such as missing headers on static pages, or issues that need an already compromised device

Testing rules #

• Use only accounts and data you own, or have the owner's permission to use.
• If you reach someone else's data, stop, don't keep or share it, and tell us right away.
• Don't degrade a service for other people, for example with heavy automated scanning.
• Don't publish details until a fix is available, or until 90 days after your report, unless we agree otherwise.
• Follow the law that applies to you.

Safe harbor #

If you research and report in good faith and follow this policy, we consider your research authorized and won't take legal action against you for it. This doesn't cover activity that breaks the testing rules, and we can't authorize testing of systems or accounts that belong to third parties.

What happens next #

• We aim to confirm we've received your report within a few days.
• We'll assess it and decide whether and how to fix it, and try to keep you updated.
• Once it's fixed, we're happy to credit you if you'd like.

These are personal projects with no bug bounty, so we don't pay for reports.

Changes #

We may update this policy at any time. Past versions are kept in the public history of this page.