Security Research & Responsible Disclosure

You've landed here because something you tried isn't accessible — a locked-down page, a permission check, or a path that doesn't behave the way you expected. If you're probing around out of curiosity or as part of responsible security research, this is the right place, not a dead end.

Scope & reporting

Full disclosure policy details live at /.well-known/security.txt. Short version: report anything you find to [email protected]. Give us a reasonable window to fix it before any public disclosure.

Ground rules

• No denial-of-service testing, no mass automated scanning, no attempts to access other users' data.
• Testing your own account, or logic/access-control issues that don't require touching anyone else's data, is welcome.
• The CTF section of this site has intentionally vulnerable challenges — that's the sanctioned place to practice exploitation techniques, not the rest of the site.

Good faith

We won't pursue legal action against good-faith security research conducted under these ground rules. If in doubt about whether something is in scope, ask first at [email protected].