Security policy

Reporting

Email [to be completed before launch: security contact address] with enough detail to reproduce the issue. Please do not open a public issue, and please give us a reasonable window to fix it before publishing. We aim to acknowledge a report within 48 hours.

In scope

This website and its API. Vulnerabilities in the platforms we build on should go to those vendors, though we would still like to hear about it.

Out of scope

• Findings from automated scanners with no demonstrated impact.
• Missing hardening headers with no exploitable consequence.
• Denial of service through volume, and social engineering of our people.

Good-faith research

We will not pursue or support legal action against researchers who act in good faith: who report promptly, avoid privacy violations and service degradation, and do not access, modify or retain data beyond what is needed to demonstrate the issue. Testing that destroys data or degrades the service for readers is not good faith.

What we do about it

Confirmed reports are triaged by severity and fixed. Where a vulnerability affected reader data we will say so, and notify the people affected and the relevant supervisory authority within the timeframes the GDPR requires.