I take security seriously and appreciate responsible reports from the community. This policy explains how to report vulnerabilities on this website and any related demos, bots, or tools (“Services”).
1. Report a vulnerability
Please report security issues via my website contact method (or the email listed on the site). Include:
- A clear description of the issue and where you found it
- Steps to reproduce (proof-of-concept is helpful)
- The potential impact (what could happen)
- Screenshots/logs (if relevant)
2. What’s allowed (good-faith testing)
You may perform limited, non-destructive testing to confirm a vulnerability, such as:
- Identifying common web vulnerabilities (e.g., XSS, CSRF, auth issues)
- Checking for misconfigurations that expose data
- Testing rate limits in a reasonable way
3. What’s not allowed
Please do not:
- Access, modify, delete, or download data that isn’t yours
- Attempt to disrupt service availability (DoS/DDoS, heavy scanning, request floods)
- Use social engineering, phishing, or physical attempts
- Attempt credential stuffing, brute force, or bypassing authentication
- Exfiltrate secrets (API keys, tokens), or publish exploit code for active issues
- Publicly disclose a vulnerability before it’s fixed or without permission
4. Safe harbor
If you:
- Follow this policy,
- Act in good faith,
- Avoid privacy violations and disruption,
I will not pursue legal action against you for your security research.
5. Response timeline
I aim to:
- Acknowledge reports within 7 days
- Provide a status update as progress is made
- Fix or mitigate valid issues within a reasonable timeframe (severity-dependent)
6. Scope
This policy covers:
- This website and its hosted pages
- Public demos, bots, and tools linked from this site
Anything not owned/controlled by me (third-party services, platforms, or links) may be out of scope.
7. Credits (optional)
If you’d like, I can credit you publicly once the issue is resolved—just mention your preferred name/handle in your report.
