The short version
- Email [email protected] with the details. Don’t open a public issue.
- For a package, you can also use a private security advisory on its GitHub repository.
- Don’t access other people’s data or damage anything, and give us reasonable time to fix it.
- We’ll acknowledge your report, keep you updated and credit you if you’d like. We don’t run a paid bounty.
How to report
Email [email protected] with “Security” in the subject. Please include:
- What the problem is and where it is (URL, package and version).
- Steps to reproduce it, or a proof of concept.
- What an attacker could do with it.
- How you’d like to be credited, if at all.
Please don’t report vulnerabilities in public issues, pull requests or social media.
Scope
- This website, devwizard.net.
- Open-source packages published by DevWizardHQ on GitHub. For these, you can also report through a private security advisory on the package’s repository.
Client projects we build are covered by their own agreements. If you find an issue in one, contact its owner, or email us and we’ll pass it on.
What we ask of you
- Only test as much as you need to show the problem.
- Don’t access, change or delete data that isn’t yours, and don’t violate anyone’s privacy.
- Don’t disrupt the site for others, for example with denial-of-service tests or spam through the contact form.
- Give us reasonable time to fix the issue before you disclose it publicly.
What we commit to
- We’ll acknowledge your report and tell you whether we can reproduce it.
- We’ll keep you updated while we work on a fix.
- We’ll credit you when we announce the fix, if you’d like us to.
We don’t offer a paid bug bounty.
security.txt
Our contact details are also published in machine-readable form at /.well-known/security.txt, following RFC 9116.
Questions about this page?
Email us and a person on the team will reply.