Vulnerability disclosure policy

Scope

This policy covers:

• Sites: posluns.ca and every posluns domain I own or manage that redirects to it.
• Projects: grclibrary.ai, aiqt.ai, cleanlanguage.ai, secureconfig.ai and auditthis.ai.
• Code: the public repositories at github.com/jposluns, including the content, rules and tooling they publish.

Services I use but do not operate, such as Cloudflare, GitHub and LinkedIn, are out of scope. Please report issues in those services to their providers.

How to report

Email jeff@posluns.ca. I read reports in English and French.

To send a confidential report, encrypt it with my OpenPGP public key. Its fingerprint is:

7CB5 FB4C E922 2E42 F304 C657 E614 97E6 9F10 F62A

Please include:

• the affected site, URL, repository or file;
• a description of the issue and its likely impact;
• the steps needed to reproduce it, with a proof of concept where possible;
• how you would like to be credited, if at all.

Please do not

• run denial-of-service tests, or anything else that degrades a site or service;
• access, change or delete data that is not yours, or keep any data beyond what you need to show the issue;
• use social engineering, phishing or physical attacks;
• run automated scans that generate heavy traffic;
• disclose the issue publicly before it is resolved, except as set out below.

What to expect

• I will acknowledge your report within 5 business days.
• I will give you a status update within 30 days, and keep you informed until the issue is resolved.

These are targets, not guarantees. If I am travelling or away, acknowledgement may wait until I return.

Coordinated disclosure

Please give me the chance to fix an issue before you publish it. I ask that you wait until a fix is released, or 90 days after your report, whichever comes first. If a fix needs more time, I will explain why and we can agree an extension.

Safe harbour

If you research and report in good faith and follow this policy, I will consider your work authorized, I will not take legal action against you, and I will not ask anyone else to. If a third party takes action against you for research that followed this policy, I will make it known that your work was authorized.

I can only give this assurance for the systems I own and operate. It does not extend to the third-party services listed as out of scope.

Recognition

I do not offer a monetary bounty. If we are ever in the same city, I would be glad to thank you over dinner or a beer.

With your permission, I will credit you by name in the GitHub security advisory for the fix, or on an acknowledgements page.

Machine-readable contact

The same contact details are published in security.txt, following RFC 9116.