SecHB security & privacy

Report a vulnerability

If you have found a security problem here, I want to hear about it, and you will not be treated as an adversary for telling me.

Machine-readable version: /.well-known/security.txt (RFC 9116). Effective 2026-09-05.

How to report

Use the contact form, and say in the first line that it is a security report so it is not read as an enquiry. RFC 9116 accepts a web address as the contact point, so that form is what security.txt names.

A dedicated security@ mailbox would be better, and will replace this once domain mail is delivering again — researchers reasonably prefer to send mail rather than fill in a form, and an encrypted report needs an address and a key. Until then this route works and is monitored.

A useful report says what you found, on which URL, and the steps to reproduce it. A single request or a short screen recording is worth more than a scanner export.

What is in scope

  • sechb.com and www.sechb.com, and the static files served from them.
  • The HTTP response headers, TLS configuration and DNS records for those two names.

What is out of scope

  • Any other host under this domain. Subdomains other than the two named above run unrelated services and are not covered by this policy or its safe harbour.
  • Denial of service, load or stress testing, and traffic volume that degrades the host.
  • Social engineering, phishing or physical attempts against me or anyone else.
  • Automated scanning at volume. This is one small static site; read it by hand.
  • Reports produced only by a scanner, with no demonstrated impact.
  • Findings that assert a missing header or a TLS setting without showing what it lets an attacker do. Best-practice observations are welcome, but they are not vulnerabilities.

Safe harbour

If you make a good-faith effort to follow this policy, I will not pursue or support a legal claim against you for your research, and I will say so in writing if you need it. Good faith means: stay within the scope above, stop as soon as you have confirmed a problem, do not access, alter or retain anyone else’s data, and give me a reasonable chance to fix it before you publish.

This safe harbour is mine to give and covers only my own claims. It does not bind the hosting provider, the registrar or any other third party, and it does not cover activity outside the scope above.

What happens next

  • Acknowledgement within three business days.
  • An assessment, and a fix or an explanation of why it is not one, within thirty days.
  • Credit on request when a report leads to a change. I will not name you without asking.

There is no bug bounty and no payment. This is a small practice and saying otherwise would waste your time.

This site is deliberately a plain one: static files, no JavaScript, no database, no cookies. The single exception is the contact form, which posts to a small handler written against the standard library alone — it binds to localhost, stores nothing, and runs under a systemd confinement that denies it every capability and all network access except the local mail service. That is the one piece of running code on the site, and naming it is more useful to you than claiming there is none.