Security Policy
Found a vulnerability in one of my sites or projects? Thank you. Here is how to report it, and what to expect back.
Reporting a Vulnerability
If the report contains any sensitive information, please encrypt it using my PGP key (see below).
If you believe you've found a security vulnerability in any of my projects or websites, please report it by emailing [email protected].
Please include as much detail as possible to help me understand and reproduce the issue:
- Description of the vulnerability
- Steps to reproduce the issue
- Affected URL(s) or project(s)
- Any proof-of-concept code or screenshots
- Your assessment of the potential impact
Response Timeline
Scope
This policy applies to:
- samdjames.uk and its subdomains
- Open source projects I maintain
- Client projects where I am the primary contact for security matters
Out of Scope
The following are generally not considered valid security issues:
- Social engineering attacks
- Physical attacks against infrastructure
- Denial of service (DoS/DDoS) attacks
- Missing security headers that don't lead to exploitable vulnerabilities
- Clickjacking on pages with no sensitive actions
- Rate limiting issues unless they lead to a significant security impact
Safe Harbour
I consider security research conducted in accordance with this policy to be:
- Authorized and I will not pursue legal action
- Exempt from restrictions in any applicable Terms of Service
- Helpful and conducted in good faith
I ask that you act in good faith, avoid privacy violations, destruction of data, and interruption or degradation of services during your research.
PGP Key
For encrypted communications, you can use my PGP key:
Fingerprint: 1C30 FCBE C309 E07F BDB0 0F09 5860 95A2 D239 4AC3
You can download the public key from here.
security.txt
This site follows the RFC 9116 standard. You can find the machine-readable security policy at:
PGP Encryption
If you don't have a PGP client set up, you can use this tool to help encrypt your message with my PGP key:
Acknowledgements
Thank you to the following security researchers who have responsibly disclosed vulnerabilities:
No reports yet. Be the first to responsibly disclose a vulnerability!