Security: reporting vulnerabilities

If you believe you have found a security vulnerability in M365.FM, please tell me. I appreciate every responsible report and will work with you to fix it quickly.

How to report

Email: [email protected]

Please use the subject line Security and include:

• the affected address (URL) or API endpoint,
• a description of the issue and its possible impact,
• the steps to reproduce it (screenshots or a short proof of concept help),
• whether and how you would like to be credited.

Please do not share the details publicly until the issue is fixed. Machine-readable contact details: /.well-known/security.txt.

What happens next

• You get a confirmation within 5 working days.
• I assess the report, keep you informed about the status and tell you when the issue is fixed.
• For the disclosure I ask for up to 90 days, or less if the fix is live earlier. We agree on the timing together.
• If you like, you will be named with thanks once the fix is live.

There is no paid bug bounty programme.

Scope

• www.m365.fm
• m365.fm
• dub.m365.fm
• api-dub.m365.fm
• img.m365.fm

Services of other providers that M365.FM uses (for example Spreaker, YouTube, Cloudflare, GitHub, Google and Microsoft sign-in) are out of scope; please report issues there directly to the respective provider.

Rules for testing

• Only access, change or delete data to the extent needed to show the issue, and only your own accounts and data. Stop and report as soon as you see other people's data.
• No denial-of-service tests, no load or mass scans, no spam, no social engineering and no physical attacks.
• Do not use a vulnerability beyond what is needed to prove it, and delete any data you obtained after reporting.

Research that follows these rules is considered to be in good faith; I will not pursue it.

Usually not accepted

• Reports from automated scanners without a demonstrated impact
• Missing security headers or cookie flags without a concrete attack
• SPF, DKIM or DMARC recommendations without a demonstrated spoofing problem
• Clickjacking on pages without sensitive actions, self-XSS, and rate limits on non-sensitive functions
• Issues that require a compromised device or browser