Security

Reporting a problem

A security report for this site goes through the contact form.

The same contact page is named in /.well-known/security.txt. There is no bug bounty. A useful report names the page, what you sent, and what you expected. Do not include someone else's email address from the signup store.

What this covers

The static site, the newsletter function, the contact function, and the files served from this host. Vendor pages linked as sources are not this site.

What a report should leave alone

• No load tests against the public host.
• No attempts to read another person's signup, and no dumping of the D1 database.
• Automated scanners that only fetch public pages are fine.