Security

I make videos about malware and security, so it would be pretty embarrassing if my own site had a hole in it 😅 If you find one, please tell me privately first. I really appreciate it.

How to report

Send an email to [email protected] with “Security” in the subject, and include:

• What you found and where (the page or address)
• Steps to reproduce it, and screenshots if you have them
• What an attacker could do with it
• How you’d like to be credited (or if you’d rather stay anonymous)

I’ll try to reply within 7 days, and I’ll keep you updated until it’s fixed. Please give me a reasonable time to fix it, around 90 days, before talking about it publicly. If it’s fixed sooner, we can agree to publish sooner.

This site’s security contact is also listed in its security.txt file, the standard place security researchers look.

What’s in scope

Problems in third-party services should be reported to those companies directly. Most of them have their own security programs.

Please don’t

• Run denial-of-service (DoS) attacks or anything that slows down or breaks the site. It runs on a single server at my home.
• Access, change or delete other people’s data. If you find any by accident, stop, don’t keep a copy, and tell me.
• Use heavy automated scanners that flood the site with requests
• Try social engineering, phishing or physical attacks
• Spam the contact forms or email addresses

Good faith

If you look for vulnerabilities in good faith and follow the rules on this page, I won’t take legal action against you for it. I see it as helping the site, not attacking it. This doesn’t cover anything outside these rules, or systems that aren’t mine.

Thanks

People who responsibly report a valid issue will be thanked here, if they want.

No reports yet. You could be the first! 🦆

← Back to the home page