Report a security problem

If you have found something, email [email protected]. That is the only address, and a person reads it.

What to send#

Enough for us to reproduce it, and nothing more.

• The URL where you saw it.
• What you did, step by step.
• What happened, and what you expected instead.
• A screenshot or a request log if you have one.

What we will do#

Four things, and we will tell you when each is done.

• Confirm we received it.
• Reproduce it, and come back to you if we cannot.
• Fix it, and say when it shipped.
• Credit you if you want to be credited, or stay quiet about it if you do not.

What we do not have#

Said plainly rather than left to be inferred.

• There is no bug bounty. We do not pay for reports.
• There is no separate security address, no PGP key and no security.txt today.
• There is no published response deadline. We will not print one we cannot evidence.

Please do not#

Three things that turn a report into an incident.

• Do not test against a customer's live site. Ours is noboringsites.com; a site we host for somebody else is theirs, not a target.
• Do not run automated scanners against a production surface.
• Do not access, download or alter anyone's data to prove a point. Describing the route is enough.

If your own site has been attacked#

Different problem, same address.

• Email [email protected] and say the site is compromised, not just broken.
• If we host it, it is ours to fix.
• Change any password you shared with anyone before you do anything else.