Responsible disclosure
If you think you have found a security problem in BPT or this site, please tell us privately first, so we can fix it before it is used.
Last updated
How to report
Send your report through the Contact page. Include what you found, where, the steps to reproduce it, and what an attacker could do with it. A short proof of concept helps; please do not include anyone else’s data.
The same address is published in this site’s security.txt.
What to expect
- We confirm we have your report within three working days.
- We tell you what we found and what we will do about it, and keep you informed until it is fixed.
- We credit you when the fix is released, if you would like to be named.
- We will not take legal action against research done in good faith within these rules.
The rules
Please:
- test only with accounts you own or were invited to, and stop as soon as you reach anyone else’s data;
- not degrade the service: no denial of service, load testing, spam or automated scanning at volume;
- not use social engineering, phishing or physical attacks against the operator of this site or its users;
- give us a reasonable time to fix the problem before you tell anyone else — 90 days unless we agree otherwise.
What is in scope
This site and the BPT application served from it. Reports about outside services we use should go to those services. Findings with no security impact — missing headers on static files with no content to protect, version banners, or self-inflicted issues — are welcome but not urgent.