Security disclosure policy

Scope

This policy covers:

• witteshadovv.dev, including the files under /.well-known/ and the published PGP key
• my public repositories under github.com/WitteShadovv that do not have their own security policy
• the Portmaster package and NixOS module I maintain in nixpkgs

Some projects have their own policy. Follow it for reports about them:

• NAILS: report to security@nails.run as described in the NAILS policy
• deferred-apps: see its policy. Reports go to the same address as below.

Out of scope:

• vulnerabilities in upstream software such as Portmaster itself, NixOS, or nixpkgs outside the package I maintain. Report those to the upstream project.
• archived repositories such as NAILS OS. They no longer get fixes.
• GitHub, GitHub Pages, and other hosting infrastructure
• HTTP response headers that GitHub Pages does not let me set
• output from automated scanners without a demonstrated impact
• social engineering, phishing, physical attacks, and denial of service

If you are unsure whether something is in scope, report it anyway.

How to report

Email security@witteshadovv.dev. Encrypt sensitive details with my PGP key, fingerprint FCEB 73CE 73A7 00A8 8548 F25D CB4B BA75 1B7B 4D4D. The key is also available through WKD for the same address.

Please do not open public issues or pull requests for suspected vulnerabilities.

Include what you can:

• the affected URL, repository, version, or commit
• steps to reproduce or a proof of concept
• the impact you see
• whether and how you want to be credited

What to expect

I maintain these projects alone, so these are best-effort targets, not guarantees.

• acknowledgment within 72 hours
• an initial assessment within 7 days
• updates while a fix takes longer than that

Coordinated disclosure

Please keep the issue private until a fix is available or we agree on a disclosure date. The default goal is disclosure within 90 days of your report. That window can move with severity, active exploitation, fix complexity, or what we agree on together.

When a fix is published, I credit you unless you prefer to stay anonymous.

Safe harbor

Good-faith research is welcome, and I will not take legal action against anyone doing it. Please test on your own systems and installs, not on other people's.

No bug bounty

There is no bug bounty and I cannot pay for reports.

Machine-readable contact

The same contact details are published in /.well-known/security.txt.