Responsible disclosure

1. Report a vulnerability

If you believe you have found a security vulnerability in this website, please tell us. We take every report seriously.

Email contact@kasiski.org with the subject line “Security vulnerability”. Please do not report vulnerabilities by WhatsApp or in public.

2. What to include

The address of the affected page, the steps to reproduce the problem, what an attacker could do with it, and how we can reach you if you would like a reply.

3. What we ask of you

Give us reasonable time to fix the problem before you share it with anyone else.

Do not access, change or delete data that is not yours, and stop as soon as you have shown the problem.

Do not disrupt the website: no denial-of-service attacks and no high-volume automated scanning. Do not use social engineering, phishing or physical attacks.

4. What you can expect from us

We confirm that we have received your report within 3 business days, keep you informed while we fix it and tell you when it is fixed. If you wish, we will thank you by name once it is fixed.

We will not take legal action against anyone who reports a vulnerability in good faith and follows this policy.

5. Scope

This policy covers this website. Problems in services we use, such as our host, our email provider or WhatsApp, should be reported to those providers.

6. Rewards

We do not offer payment for reports. Our contact details for security reports are also published in machine-readable form at /.well-known/security.txt.