← home

Report a vulnerability

Found a security issue in this site? Thank you — please tell us privately first. Reports are encrypted in your browser to a key only the operator holds, so nobody in between can read them.

1 · Write your report

Include what you found, where, and how to reproduce it. Don’t include data you shouldn’t have accessed.

Disclosure key not loading? Paste it here

Disclosure guidelines

Report privately and give us reasonable time to fix before any public disclosure.
Don’t access, modify, or delete data that isn’t yours; don’t degrade the service (no DoS, no spam).
Stay within the law. Good-faith research reported responsibly is welcome.
No bug-bounty payments are offered — this is a personal project — but credit is gladly given if you’d like it.

Site operator

your keys stay in this browser

Generate the disclosure key

Creates an RSA-4096 keypair in your browser. The private key + passphrase never leave this device — save them safely. Publish the public key as .well-known/pgp-key.txt.

Public key — publish this Private key — save offline, never publish

Decrypt a report

Paste your private key, its passphrase, and the encrypted report you received.

Decrypted report