Security Policy

Reporting a Vulnerability

Report suspected security issues to [email protected]. Reports are accepted in English. This policy is also published in machine-readable form at /.well-known/security.txt.

• Please include enough detail to reproduce the issue: affected URL, steps taken, and expected versus observed behavior.
• Proof-of-concept code, screenshots, or request and response captures are welcome.
• Please send one issue per report so each can be tracked separately.

What To Expect

amroot.com is a personal site maintained outside of working hours, so the timelines below are good-faith targets rather than contractual guarantees.

• Acknowledgement of your report within 5 business days.
• An assessment of validity and severity, with a status update, within 14 days.
• Notification when the issue is resolved, or an explanation if it is not accepted.

Scope

In scope: the amroot.com domain and its subdomains, including the static site content, its HTTP response headers, and its DNS configuration.

Out of scope: third-party platforms linked from this site, including Medium, GitHub, and LinkedIn. Those services run their own disclosure programs and should be contacted directly. Findings that affect only a third party's infrastructure are not covered here.

The following are not accepted as vulnerabilities:

• Volumetric denial of service, load testing, or any activity that degrades availability.
• Social engineering, phishing, or physical attacks against the site owner or any provider.
• Spam, mail-bombing, or rate-limit findings with no demonstrated security impact.
• Reports requiring physical access to a device, or a fully compromised browser or operating system.
• Missing hardening headers or best-practice deviations with no demonstrated exploit path.
• Automated scanner output submitted without validation or impact analysis.

Safe Harbor

Security research conducted in good faith and in accordance with this policy is welcome, and no legal action will be pursued in response to it. To stay within this protection, please:

• Avoid accessing, modifying, exfiltrating, or storing data that is not your own. If you encounter personal data, stop and report it immediately.
• Avoid degrading, disrupting, or denying service to others.
• Limit testing to the systems listed as in scope.
• Allow a reasonable period for remediation before disclosing an issue publicly.

This safe harbor covers only claims that the site owner is entitled to bring. It cannot bind hosting providers, third-party platforms, or any other party.

Recognition and Rewards

There is no monetary bounty. amroot.com is a personal site and does not operate a paid bug bounty program. No payment will be offered or issued for any report, regardless of severity.

Valid reports are credited publicly by name or handle, with thanks, unless you prefer to remain anonymous. Just tell us which you would like when you report.