What this covers

Security research is welcome on anything I ship.

• This site, and any app or service I run or publish.
• Closed source: use the product, hit the APIs, explore what is available to you.
• Open source (repos on /open-source): read the code. Use that to your advantage.

Discovery vs exploitation

Identifying and reporting vulnerabilities is permitted. Exploiting them is not. Causing service disruption, accessing or exfiltrating data without authorization, or otherwise acting on a vulnerability against users or systems crosses into exploitation and may result in legal action.

If it is serious

Accounts, data, or production at risk — reach out privately first.

• Contact /support or [email protected] with enough detail that I can reproduce it.
• Do not post exploit steps, tokens, or user data in public.
• Give me time to fix it before you go public.

Not security

• Small bugs in an open repo → /open-source/contributing.
• “This button looks wrong” → in-app feedback or /support when there is one.

Credit

Helpful reports sometimes get a mention on /contributions. No bounties yet — just thanks when it is deserved.