Please note that this program does not offer rewards for bug submissions as JamieWeb is just a small personal project.
This disclosure program is limited to assets in the scope found at the bottom of this page.
Things To Look For
- Web application vulnerabilities (Command Injection, SSRF, CSRF, XSS, etc)
- Security misconfigurations
- Suggested security improvements
- Information leakage
- Multi-byte/binary exploitation
- Tor Hidden Service de-anonymization
- Security header configurations
- Content Security Policy (CSP) bypass
- DNS record configuration (SPF, DKIM, DMARC, CAA, etc)
- TLS configuration
- Code security audit/review
- Software that is more than 24 hours out of date
Feel free to use automated tools as long as you do not cause network/service disruption for me or third-parties.
Testing must not cause issues for other organisations such as hosting providers, network operators or ISPs.
- Let me know of any potential vulnerabilities as soon as possible and I will make every effort to resolve the issue quickly.
- Share with me the full details of any vulnerability including steps to reproduce if applicable.
- Provide me a reasonable amount of time to fix the issue before disclosure to the public or a third-party.
- Try to avoid degradation of service, destruction of data or privacy violations.
I will make every effort to abide by HackerOne's disclosure guidelines: https://hackerone.com/disclosure-guidelines
While researching, please do not attempt the following:
- Denial of service (DoS)
- Spoofing or hijacking
- Man in the Middle (MiTM) or interception
- Attacks which require physical presence on the network of a user
- Domain name hijacking or theft
- Account hijacking or theft
- Social engineering
- Physical/real-life attacks
- Anything that could falsely lower the reputation of me or my website
- Anything that could falsely get me in trouble
- Attacks on 3rd-party systems that are out of my general control
- Thank you shown at "https://hackerone.com/jamieweb/thanks".
Please note that this program does not provide monetary rewards for bug submissions.
Researchers who submit non-issues, false issues or purely opinion-based issues may not be thanked publicly.
Thank you for helping keep JamieWeb safe!