Security & Disclosure

If You Find Something, Tell Me

Email security@jamesdennis.org with:

• A clear description of the vulnerability.
• The steps needed to reproduce it.
• The affected URL and any relevant headers or request payloads.
• Your name or handle, if you'd like credit.

Please do not post details publicly until I've had a chance to respond, and do not access, modify, or exfiltrate data beyond what is strictly necessary to demonstrate the issue.

If you prefer encrypted communication, my PGP key is available on request.

If you report in good faith, I will:

• Acknowledge your report within 48 hours.
• Triage and confirm the issue within 5 working days.
• Keep you informed of the fix progress at reasonable intervals.
• Credit you in the fix note (or keep you anonymous, if you prefer).
• Not pursue legal action against you for research conducted in accordance with this policy.

In scope

• jamesdennis.org — the site you are on right now.
• scrapeshield-pro.vercel.app — the ScrapeShield Pro application, once it moves to its subdomain.
• Sites I manage under a retainer— with the explicit permission of the site's owner. Do not probe a client site without that permission; report it to me and I will obtain consent.

Out of scope

• Denial-of-service and volumetric attacks.
• Social engineering of me or any client.
• Physical attacks, or attacks on my home or office network.
• Spam or marketing reports of pre-existing public listings.
• Vulnerabilities in third-party services (Cloudflare, Vercel, Resend, etc.) — report those to the provider directly.
• Automated scanner output without a demonstration that the finding is exploitable.
• Clickjacking or tabnabbing on pages that already send appropriate headers.

If you conduct security research in accordance with this policy, in good faith, and without causing harm to me, my clients, or third parties, I will:

• Consider your research authorised.
• Not report you to law enforcement.
• Not pursue a civil claim against you.
• Work with you to understand and resolve the issue.

This safe harbour applies only to research conducted within the scope above and in compliance with applicable law. It does not protect anyone who exploits a vulnerability for personal gain, accesses data beyond what is needed to demonstrate the issue, or causes disruption.

For context, this is the baseline I maintain:

• HTTPS everywhere, with HSTS enabled.
• Cloudflare WAF and bot filtering on all proxied sites.
• Automated dependency updates on a weekly cadence.
• Content Security Policy restricting where scripts and frames can load from.
• No user data stored on the site itself.
• Strong authentication on all infrastructure accounts.

If you are a client on the Full Webmaster retainer, this is what your monthly fee maintains and improves. The report you receive each month documents what was blocked, what was tuned, and what changed.

Security research makes the web safer for everyone. If you find something worth reporting, thank you for taking the time. I'll respond in kind.