Skip to content
Ryan Henrick
MenuClose

Disclosure policy

Found a problem with this site?Tell me. Here is how I handle it.

Email security@ryanhenrick.com. Include what you found, where, and the steps to reproduce.

Reporting a problem with my site

I will acknowledge your report and tell you when it is fixed.

Please

  • Test only ryanhenrick.com and its subdomains that you can reach publicly.
  • Stop at proof. Do not read, change or keep other people's data.
  • No denial of service, spam, social engineering or physical attacks.
  • Give me reasonable time to fix before you publish.

My side

  • I will not take legal action against good-faith research that follows this policy.
  • I will credit you if you want credit.
  • This is not a bug bounty. I do not pay for reports.

If I find a problem on a system I was not hired to test

I do not go looking. If I come across something by accident, I stop, keep no data, and try to tell the owner through their security contact or security.txt.

I do not publish details until it is fixed or the owner has had a reasonable time to respond, and I will not publish without a conversation first.

If I find a problem during an engagement

It goes to you in the report, and straight away if it is serious. It is not shared with anyone else.

Machine-readable contact details: security.txt