Reporting
Email nic@argand.org. PGP-encrypted
reports are welcome and encouraged for anything sensitive — the public
key is at /.well-known/pgp-key.txt (fingerprint 78CB 8742 6797 8D42 9847 B989 DC17 2983 F4C7 1CAB).
The machine-readable version of this policy lives at /.well-known/security.txt.
Please include enough detail to reproduce: affected URL or component, steps, and impact.
Scope
In scope:
- argand.org and its subdomains.
- The public website, beta, and same-origin public endpoints.
Out of scope for now:
- Internal components that are not reachable from the public internet.
- Findings that require physical access, social engineering, or denial of service.
- Reports generated solely by automated scanners without a demonstrated impact.
What to expect
- Acknowledgement of your report as soon as I can — this is a one-person project, so please allow a few days.
- A good-faith effort to validate and fix confirmed issues promptly.
- Credit if you'd like it, once a fix has shipped.
Safe harbor
If you make a good-faith effort to comply with this policy during your research, I will consider your testing authorized, will not pursue or support legal action against you for it, and will work with you to understand and resolve the issue quickly. Good faith means: don't access or modify data that isn't yours, don't degrade the service for others, and give me a reasonable chance to fix things before public disclosure.
Bug bounty
There is currently no paid bug-bounty program. Please do not assume that a report is eligible for payment unless a written program says so.