Vulnerability disclosure
Scope
This policy covers this site: morningstarsecurity.com and the software behind it. It can't and doesn't cover anyone else: not the publishers we link to, not the services we use (Stripe, Amazon SES, SMTP2GO, YouTube), each of which has its own disclosure programme. A bug in their systems belongs with them.
How to report
Email security@morningstarsecurity.com with what you found, where (a URL or endpoint), and how to reproduce it. A proof of concept is welcome; a working exploit chain is not required. Please use this address rather than the feedback form: vulnerability reports belong on a channel monitored for them, and reports to that address always get a reply. The machine-readable version of this page is /.well-known/security.txt (RFC 9116).
What we promise
- A human reads every report, and you'll get an acknowledgement.
- We'll tell you what we make of it and when it's fixed.
- Credit by name if you want it, silence if you'd rather.
- No legal action against good-faith research that stays within the ground rules below.
The site is run by one person, so there is no bug bounty, response-time SLA or hall of fame. There is no PGP key either, so reports come by plain email. If you need an encrypted channel, say so in a first mail without the details and we'll set one up. Reports are triaged by severity.
Ground rules
- Don't access, modify or delete other people's data — if proving the bug shows you someone else's record, stop there and tell us.
- No denial-of-service or spam testing.
- No social engineering of the editor, readers or providers, and no physical attacks.
- Take the minimum needed to demonstrate the issue, and don't keep or share data you touched along the way.
- Give us a reasonable chance to fix it before publishing details.