Security

If you find a security issue on this site, please report it responsibly.

Contact: security@joshuamorris.info

Encrypted reports are welcome. The OpenPGP public key is at /security/openpgp.asc. Fingerprint: 7431 7ED0 ED52 E6CF DA24 E668 91B9 4F5F 59D4 00E7 (also in /.well-known/security.txt).

Useful details: what you found, where it lives (URL or component), steps to reproduce, and what impact you believe it has. Screenshots or proof-of-concept are fine when they help explain the issue.

Scope: This page and /.well-known/security.txt describe how to reach me. They do not grant permission to attack, damage, disrupt, access private information, or exceed lawful authorization.

Bug bounty: There is no bug bounty program unless one is explicitly offered here or in a separate announcement.

Good-faith reports are welcome. I will do my best to acknowledge and investigate credible issues.