Security
Responsible disclosure
Found a security issue with this site? Thank you, genuinely. Here's how to tell me, what's in scope, and what happens next. There's a machine-readable security.txt too.
The short version Report privately through the
contact form, give me the details to reproduce it, and give me a reasonable window to fix it before going public. I won't take legal action against good-faith research that follows this policy.
How to report
Send the report through the contact form with "Something else" as the topic and "SECURITY" at the start of your message. Include as much as you can:
- The URL, page or endpoint affected.
- Clear steps to reproduce, or a short proof of concept.
- What an attacker could do with it (the impact).
- Any logs, requests or screenshots that help.
This is a static personal site, so please keep proofs of concept non-destructive and don't run automated scanners hard enough to affect availability for anyone else.
In scope
unixsingh.com and its subdomains that I control.- The site's own code: content security policy, headers, the contact form flow, client-side logic.
Out of scope
- Third-party platforms I only link to (LinkedIn, GitHub, Buy Me a Coffee, the newsletter and form providers). Report those to the platform directly.
- Findings that need a already-compromised device, physical access, or social engineering of me.
- Missing "best practice" headers with no demonstrable impact, rate-limiting on a static site, and automated-scanner output with no working proof.
What you can expect
- An acknowledgement, normally within 1–2 working days.
- An honest assessment of severity and a fix timeline.
- Credit on this page if you'd like it (and if the finding is valid). I can't offer money, this is a personal learning-in-public project, not a funded programme.
Safe harbour
If you make a good-faith effort to follow this policy, I'll treat your research as authorised, won't pursue legal action, and will work with you on disclosure. Please don't access or modify other people's data, and give me a fair chance to fix things before publishing.
Credits
Valid reports that opt in for credit will be listed here. Nothing to show yet, be the first.
Inside