Security
If you have found something, this is how to tell me. Reports are welcome and are not treated as an accusation.
Last reviewed
Reporting
Email kpleelaaravind@gmail.com with “Security” in the subject line. Please include what you found, where, and enough detail to reproduce it.
Please report privately first rather than publishing. I will acknowledge as soon as I can and tell you honestly whether I can fix it and roughly when. If a fix will be slow, I would rather say so than go quiet.
Scope
In scope: this website, and the publicly reachable ITISYOU products.
Out of scope, and please do not attempt these:
- Denial of service, load testing, or anything that degrades a service for others.
- Social engineering of any person, and physical attacks of any kind.
- Accessing, modifying or exfiltrating data belonging to anyone but yourself. If you find a way to reach someone else’s data, stop, and tell me what you found rather than how much you could take.
- Automated scanning that generates significant traffic.
- Third-party services these products depend on. Report those to their owners.
What I can offer
Honest acknowledgement, a real answer about whether and when it will be fixed, and credit if you would like it. There is no bug bounty programme and no payment — this is an independent project funded out of a wage, and pretending otherwise would waste your time.
What is not claimed
Nothing here is described as unhackable, fully secure, or guaranteed. It is a small project built by one person, and the honest position is that unknown issues almost certainly exist. That is the reason this page has a reporting address on it.
What this site does
The main site is static, has no accounts, no forms, no database and no user data. It sends a Content Security Policy that blocks scripts and connections to any external host, along with the usual protections against MIME sniffing and clickjacking. That removes several classes of problem outright rather than defending against them.
The products differ, because they have accounts and handle real data. Each publishes its own security information, and a report about one of them is best sent to the same address above.
This page covers the main ITISYOU website only. Each product publishes its own policies, because what they do genuinely differs — see the network. Questions to kpleelaaravind@gmail.com.