←Home

/ security

Security

Found a hole in kostis.wtf or something I built? Tell me privately first. I read every report myself and answer each one.

To
••••••••••••••••••••
Subject
Security: short title

What you found, the steps to reproduce it, what it affects, and a proof of concept if you have one.

Write a report
security.txtRaw
Contact:
mailto:••••••••••••••••••••
Expires:
2027-10-06
Preferred-Languages:
en, el
Policy:
/security

Keys

  • PGP

    On request

    Not published yet. Ask by email and I will send it over a channel you can verify.

    Encrypt anything sensitive with this.

  • SSH

    On request

    Not published yet. Ask by email and I will send it over a channel you can verify.

    Check that a signed commit or server really is mine.

Disclosure

  1. 01

    You report it

    Day 0

    Email me privately with the steps to reproduce, what it affects and a proof of concept if you have one.

  2. 02

    I acknowledge

    72 hours

    You get a human reply confirming I have it, and a first read on severity.

  3. 03

    I fix it

    ≤ 90 days

    I keep you updated while I work on it. Critical issues go first, everything else is patched in order.

  4. 04

    We disclose

    After the fix

    Once it is fixed you are free to write about it. I credit you, if you want the credit.

Scope

In scope

  • kostis.wtf and every page on it
  • The API under kostis.wtf/api
  • Accounts, sign-in and the dashboard
  • Private messages and their encryption
  • Public repos on my GitHub

Out of scope

  • Cloudflare, Supabase, GitHub and other third parties
  • Denial of service and load testing
  • Phishing or social engineering
  • Scanner output with no working proof
  • Missing headers or SPF / DMARC with no real impact
  • Self-XSS and clickjacking on pages with no actions

Safe harbour

If you act in good faith I will not take legal action or report you. That means staying in scope, using your own accounts, touching no more data than it takes to prove the bug, not degrading the site for anyone else, and giving me a fair chance to fix it before going public.

Bug bounty

There is no paid bug bounty. This is a one-person site. Valid reports get a proper thank-you and credit in the write-up, under the name you choose or anonymously.