Security
I appreciate reports of security issues affecting this website, its infrastructure, or services associated with the cherryfox.dev domain.
This page provides information for security researchers, users, and anyone who discovers a potential vulnerability.
Reporting
If you believe you have found a security vulnerability, please report it privately using the contact method listed in security.txt.
When reporting an issue, please include as much of the following information as possible:
- A clear description of the vulnerability.
- The affected URL, endpoint, service, or component.
- Steps required to reproduce the issue.
- The potential security impact.
- Proof-of-concept material where appropriate.
- Any relevant request, response, log, or error information.
- Your preferred method of contact.
Please do not include passwords, authentication tokens, private keys, personal data, or other sensitive information unnecessarily.
Responsible Disclosure
Please allow reasonable time for an issue to be investigated and, where appropriate, remediated before publicly disclosing technical details.
Security researchers are asked to avoid actions that could negatively affect the availability, integrity, or confidentiality of the site or its users.
In particular, please do not:
- Access, modify, or delete data belonging to other users.
- Attempt to gain persistent access to systems.
- Perform denial-of-service or resource-exhaustion attacks.
- Use social engineering against people or third-party providers.
- Access credentials, private communications, or other sensitive information beyond what is necessary to demonstrate the issue.
- Destroy or alter data.
- Publicly disclose an exploitable vulnerability before it has been given reasonable opportunity to be addressed.
If sensitive information is encountered accidentally while investigating a vulnerability, stop accessing it and report the exposure.
Scope
The primary scope of this policy is:
- The
cherryfox.devdomain. - Subdomains operated as part of the
cherryfox.devdomain. - Public-facing services directly operated by me and exposed through the
cherryfox.devdomain or its subdomains.
Third-party services and infrastructure are generally outside the direct scope of this policy. These may include hosting, DNS, CDN, analytics, external authentication, feed, badge, and other third-party services.
A vulnerability in a third-party service should normally be reported to the provider responsible for that service.
Out of Scope
The following generally do not constitute security vulnerabilities on their own:
- Missing security headers without a demonstrated security impact.
- Best-practice recommendations without an exploitable vulnerability.
- Automated scanner findings without evidence of impact.
- Self-XSS requiring the victim to execute attacker-controlled code themselves.
- Issues that only affect outdated or unsupported browsers.
- Denial-of-service testing.
- Spam, phishing, or content submitted through intentionally public functionality.
This list is not exhaustive. Reports are considered based on their actual security impact.
Disclosure Timeline
There is no fixed remediation deadline or guaranteed resolution time. I will aim to acknowledge reports and investigate them as reasonably as possible.
Please allow reasonable time for investigation and remediation before publicly disclosing a vulnerability.
Safe Harbour
Good-faith security research is welcome.
Researchers who follow this policy, avoid accessing or modifying data unnecessarily, and stop testing when a vulnerability has been sufficiently demonstrated will be treated as acting in good faith.
Nothing on this page grants permission to violate applicable law or the terms of third-party services.
security.txt
A machine-readable security contact and disclosure policy is also available at: