Scope
This policy applies to systems I operate directly:
jankesec.com and its subdomains- Published tooling and research code released under the jankesec name
It does not cover third-party services this site depends on. Report those to the operator concerned — the analytics provider, DNS host, or certificate authority as applicable.
How to report
Send the report to the address listed insecurity.txt. For anything containing exploit code, proof-of-concept payloads, or unpublished technical detail, encrypt it with thePGP key first.
A report is easiest to act on when it contains:
- The affected host, endpoint, or artefact
- Reproduction steps precise enough to follow without guessing
- What an attacker gains — the impact, not just the anomaly
- Any preconditions: authentication state, timing, configuration
Private by design
Prepare the report locally.
This helper formats a draft in your browser and opens your mail application. Nothing is uploaded by this site. Encrypt sensitive details and attachments with the published PGP key.
What happens next
I acknowledge reports and keep you informed as the fix progresses. If a report turns out to be out of scope or already known, I will say so plainly rather than leave it unanswered.
Public write-ups are published after a fix is available. If you want credit, say so in the report and tell me how you want to be named; if you would rather stay anonymous, that is the default.
Safe harbour
Research conducted in good faith under this policy is authorised, and I will not pursue legal action over it. Good faith means:
- Access only the data strictly needed to demonstrate the issue, and stop there
- Do not degrade availability — no denial of service, no automated flooding
- Do not modify or destroy data belonging to me or to anyone else
- Do not pivot to third-party systems from any foothold you find
- Do not disclose publicly before a fix is available, or before we agree otherwise
If you are unsure whether a technique crosses a line, ask before running it. Asking first has never cost anyone a finding.
Out of scope
- Missing headers or TLS options with no demonstrated exploit path
- Automated scanner output submitted without verification
- Social engineering of any kind, and physical attacks
- Rate limiting or volumetric findings on a static site
- Vulnerabilities requiring a fully compromised client to exploit