Vulnerability disclosure policy

If you believe you've found a security vulnerability in this website, I'd like to hear about it. This policy is referenced from /.well-known/security.txt (RFC 9116).

Scope

• In scope: theonlysecurity.com and its subdomains, including the contact form endpoint.
• Out of scope: third-party services (Cloudflare, Resend, GitHub), denial-of-service, spam, social engineering, physical attacks, and reports from automated scanners without a demonstrated impact.

How to report

Email security@theonlysecurity.com with a description of the issue, the affected URL, steps to reproduce, and the impact you observed. Please don't include personal data you may have accessed.

What to expect

• Acknowledgement within 3 working days.
• An initial assessment within 10 working days.
• Updates until the issue is fixed, and credit on this page if you'd like it.

This is a personal website; there is no bug bounty.

Safe harbor

I won't pursue legal action for good-faith research that follows this policy: test only against your own data, stop and report as soon as you confirm a vulnerability, avoid privacy violations and service degradation, and give me reasonable time to fix the issue before any public disclosure.