Vulnerability disclosure

Commitment & Scope

Security research is essential to keeping systems resilient. If you identify a flaw in infrastructure I maintain or open-source software I publish, I want to review it, deploy a fix promptly, and give you appropriate credit.

This policy covers systems directly under my operational control:

• The jankesec.com web infrastructure and associated routing records
• Public repositories and tools maintained under the jankesec organization

Third-party dependencies, upstream package ecosystems, or external hosting providers should be reported directly to their respective maintainers unless the vulnerability is caused by my specific integration or deployment logic.

Submitting a Finding

Please send all security disclosures to [email protected], as declared in /.well-known/security.txt.

If your report includes functional exploit payloads, reproduction code, or sensitive details, encrypt the message with my public PGP key.

To ensure a swift investigation, a useful report contains:

• The exact target: host, endpoint, repository, commit SHA, or release version
• Deterministic, step-by-step reproduction instructions or a minimal test script
• Demonstrated security impact: the practical consequence beyond a configuration discrepancy
• Any necessary preconditions (such as privilege level, timing constraints, or network state)

Response & Remediation Timeline

I treat incoming disclosures with the same urgency and technical respect I expect when submitting vulnerability research to other engineering teams:

• Initial acknowledgement: Within 48 hours of receipt.
• Triage & validation: Within 5 business days, confirming reproducibility and severity.
• Remediation: Deploying an effective patch as quickly as testing permits.
• Coordinated release: Standard 90-day disclosure windows apply. Public write-ups, advisories, or release notes are coordinated mutually once patches are live.
• Attribution: You will be credited in advisories, changelogs, or repository release notes unless you prefer to remain anonymous.

Safe Harbor Commitment

Good-faith security research conducted within these boundaries is considered authorized. I will not pursue civil lawsuits or request law enforcement action against researchers who adhere to these principles:

• Avoid disrupting service availability or degrading system performance (no DoS, DDoS, or destructive load testing).
• Do not access, download, or alter any personal data or operational state beyond what is strictly necessary to demonstrate the finding.
• Do not pivot to third-party infrastructure or connected systems from an initial finding.
• Allow a reasonable window for patch development and deployment before publishing details publicly.

Out of Scope

To avoid spending time on noise, the following items are excluded from scope:

• Missing HTTP security headers or TLS configuration options with no demonstrated attack vector on static content
• Unverified output from automated vulnerability scanners (Nikto, Nessus, Burp Suite automated sweeps)
• Volumetric traffic, rate limiting checks, or resource exhaustion against static web hosting and CDN edges
• Social engineering, phishing, or physical attacks of any nature
• Scenarios requiring pre-existing complete root compromise of the user client device