Security & Responsible Disclosure
I build and host my own systems, and I take their security seriously. If you find a vulnerability in any of my sites or services, I want to hear about it — here's how, and the commitments I make to good-faith researchers.
How I run things
- Self-hosted on owned hardware — my sites and internal tools run on my own machines, not rented cloud instances.
- Outbound-only tunnel — services are published through a tunnel with no exposed inbound ports on the origin.
- Encrypted in transit — everything is served over HTTPS/TLS.
- Private apps are gated — internal dashboards and data live behind authentication and are not publicly reachable.
How to report
Email [email protected] with enough detail to reproduce the issue: the URL or service, the steps, and the impact. A proof-of-concept helps. I'll acknowledge receipt, keep you updated, fix validated issues as quickly as I reasonably can, and credit you if you'd like.
Scope
In scope: szczleon.com, app.szczleon.com, files.szczleon.com, and other services clearly operated by me.
Out of scope: social engineering, physical attacks, denial-of-service / volumetric testing, spam, and issues in third-party services I don't control (for example my CDN or email provider — please report those to the provider).
Ground rules for testing
- Only test against your own accounts and data — don't access, modify, or destroy anyone else's.
- Don't run destructive tests, automated high-volume scans, or anything that degrades service for others.
- Give me a reasonable time to remediate before any public disclosure, and don't publish data you encounter.
- Stay within the law.
Rewards
I don't run a paid bug-bounty program at this time, but I'm grateful for reports and will happily give public credit to researchers who want it.