Security Policy
This site is static: no accounts, forms, databases, cookies, or third-party scripts. It is served over HTTPS with a strict Content Security Policy and other security headers.
Reporting a vulnerability
Please report privately to me on LinkedIn. Include what you found, where, and steps to reproduce. I aim to reply within 5 business days and to fix confirmed issues within 30 days.
Safe harbor
Good-faith research that avoids privacy violations, data destruction, and service disruption is welcome. I will not pursue action against anyone who follows this policy.
Out of scope
- Denial-of-service or load testing
- Reports from automated scanners without a demonstrated impact
- Issues in third-party services such as GitHub, Vercel, or Roblox. Please report those to the vendor.
The machine-readable contact file is at /.well-known/security.txt.