Security and Vulnerability Reporting Policy

Services Covered by This Policy

This policy covers all services directly operated by me. Services can be identified by the following means:

• The website has a .well-known/security.txt that links to this policy.
• The reverse DNS of an IP address resolves to one of the following domains:
  • jack.is
  • jack.computer
  • jkp.sh
  • platten.me

Acceptable Use

We generally invite security researchers to search for vulnerabilities in our services. We kindly ask to not put any actual user data or production systems at risk.

Classification of Vulnerabilities

We will consider a vulnerability report most likely as relevant if it reports one of the following problems:

1. The vulnerability can be used to directly access non-public information that either reveals further security relevant problems or contains user data, credentials, or sensitive data in general.
2. The vulnerability can be used to disrupt the orderly operation of a service (Denial of Service).
3. The vulnerability can be used to manipulate data within the service.
4. XSS, CSRF, RCE, authentication/authorization bypass, SQL injections, etc. are considered relevant.
5. Known vulnerabilities with a CVSS score greater than 7 that have not yet been patched by the vendor and should therefore be mitigated by other means until the patch is released and installed.

We will consider a vulnerability report as NOT relevant if it reports one of the following problems:

1. Missing security features, for example HTTP headers, if they are not actually preventing a vulnerability.
2. Publicly accessible version strings of used software.
3. Security vulnerabilities that can only be used within the scope of the used account.
4. Publicly available information even when retrieved over usually non- public channels (i.e. APIs).
5. The vulnerability exists in a third party software and is not deemed worthy of fixing by the upstream project.

Reporting Vulnerabilities

Report vulnerabilities via e-mail to security@jkp.sh.

Please make sure that you include the following information:

• Which service is affected
• How can the bug be used/exploited
• Explanation of the risk
• If possible, include an estimated CVSS score

Reports will be answered within 48 hours. If you have not received an answer within that time frame, feel free to contact us again. Please do not ask for updates on a ticket repeatedly as it may take time to resolve the issue.

For used open source software, we recommend to file bug reports and/or pull requests against the upstream repositories. This includes hardening instructions in the installation documentation.

If you are reporting a known vulnerability, please include a reference to the original vulnerability report and/or CVE number.

Bug Bounties / Vulnerability Rewards

There are no bug bounties or vulnerability rewards at this time.

About This Policy

This policy is MIT licensed. Feel free to suggest modifications and additions here.