← back to the portal

Responsible disclosure

How to report a vulnerability to us · Last updated: August 2, 2026

We publish a site about cybersecurity. It would be inconsistent not to have a clear way for people to tell us when something of ours is broken. If you found a vulnerability in InfoSecDash, this page tells you how to report it and what you can expect from us.

How to report

Write to us at [email protected] with the subject "Security report", or use the contact page. To help us act fast, it helps to include:

  • The affected URL or component.
  • Steps to reproduce it, with enough detail for us to see it ourselves.
  • What impact you think it has.
  • Whether you'd like public credit, and under what name.

What we guarantee you

  • Acknowledgment within a maximum of five business days. A response from a person, not an automated one.
  • We will not pursue legal action against anyone who investigates and reports in good faith following this policy. This commitment is the whole point of this page: no one should risk a legal problem for telling us about a flaw of ours.
  • We'll keep you informed on whether the report is confirmed and when it's fixed.
  • We'll credit you if you want, and respect your anonymity if you'd rather.
  • We don't offer financial rewards. This is a project with no revenue, and we'd rather say so plainly than imply a payment that doesn't exist.

What we ask of you

  • Give us time before disclosing it. Ninety days is the industry standard and seems reasonable to us. If the flaw is serious and already being exploited, say so and we'll treat it with different urgency.
  • Don't access data that isn't yours. If you stumble onto other people's data, stop and let us know. Demonstrating that access is possible is enough; there's no need to extract anything.
  • Don't degrade the service. No denial-of-service testing, mass brute-forcing, or spamming the forms.
  • Don't modify or delete anything that isn't yours.
  • No social engineering against us, our providers, or our readers.

Scope

In scope: the domain infosecdash.com and all its subdomains, the public site, the contact and subscription forms, the public API, and the newsletter system.

Out of scope:

  • Third-party services we use but don't control: Cloudflare, Unsplash, our email provider, the outlets we link to. Report those directly to them.
  • Findings without demonstrable impact: missing headers that don't lead to a concrete attack, raw automated scanner output, or software versions without an associated exploitable vulnerability.
  • Social engineering and physical attacks.
  • The content of the news stories. If the error is a wrong fact in a report and not a technical flaw, that goes through the corrections policy instead.

Our own track record

We audit this site ourselves and fix what we find. Among other things we've closed a stored XSS caused by incomplete escaping in HTML attributes, a server-side request that could be redirected toward the internal network, and a denial-of-service triggerable through a third party's robots.txt. We mention this because asking you to report without admitting we've also gotten things wrong would be asking in only one direction.

security.txt file

This information is also available in machine-readable form, per the RFC 9116 standard, at /.well-known/security.txt.