Reporting a security problem

If you have found a security hole in this site or any service I run, please tell us. You do not need permission to report a real problem you found while acting in good faith.

How to report

Email [email protected]. Tell us what you found, how to make it happen again, and how bad you think it is. A working example helps.

What happens next

• We will let you know the report arrived.
• We will make a real effort to confirm and fix true problems.
• We will not take legal action against research done in good faith that does not invade privacy, destroy data, or knock services offline.

What we do not accept

Attacks that flood the service, tricking people, physical break-ins, and raw output from automated scanners with no proof of real harm.

Machine-readable policy: /.well-known/security.txt