Every page on desktest.net runs entirely in the browser against the user's local drivers. There is no backend. The _headers file in this repo locks each path's connect-src to exactly the local services that path needs. View source on any page to verify.

Any bug that breaks this contract (data exfiltration, a network call to anything other than the documented local endpoints, a CSP bypass, a vendor-library-loaded-from-CDN) is in-scope and welcome.

Do not open a public GitHub issue for security reports. Send details to:

• Email: hello@tech1k.com
• Subject prefix: [security]
• Encrypt with PGP if your finding is sensitive. PGP key available on request.

Include:

• The page or file affected (URL on desktest.net plus path in the repo).
• A reproduction (browser, OS, exact steps).
• What you observed vs. what should have happened.
• Optional: a suggested fix.

You will get an acknowledgement within 72 hours. Disclosure is coordinated; the typical embargo is 30 days from the fix being deployed.

• Network calls from a desktest.net page to anything other than the same-origin static files or the documented local-loopback diagnostic ports.
• CSP bypasses, XSS, or HTML/CSS/JS injection that lets attacker-controlled origin run code in a desktest.net tab.
• Storage leaks: anything that writes user data to persistent storage. The tools keep no state between sessions; Copy Diagnostic Report writes only to the clipboard, on an explicit click.
• Subresource Integrity gaps on bundled third-party files (sigpad-test/SigWebTablet.js and scanner-test/utif.js).
• Permissions-Policy or _headers misconfiguration that allows wider browser-API access than the tool needs.
• Bugs in the mailto: send-to-IT that allow header injection.

• Browser bugs (report to the browser vendor).
• Vendor driver bugs in FIS WebScan, Topaz SigWeb, or the upstream Topaz SigWebTablet.js library (report to the vendor).
• Self-XSS or "social engineer the user into pasting JS in DevTools."
• Missing security headers on static files that carry no user data (the LICENSE and the docs/ hash files).
• DoS via running the diagnostic in a loop. The page is meant to be run by humans on demand.
• Issues with vendor-managed endpoints we connect to for reachability checks (e.g., myhub.sitelink.com).
• Issues with the Cloudflare Pages deployment platform itself (report to Cloudflare).

None. This file exists; the advisories list is currently empty.

Researchers who report a valid in-scope vulnerability and coordinate disclosure are publicly credited (in the repository's release notes and the relevant page footer) if they want. No paid bug bounty at this time.