Security policy

aahmed.org

If you have found a security problem in this site or in one of my open-source projects, I would like to hear about it. This page explains how to report it and what you can expect from me.

Scope

• This website, aahmed.org.
• The public repositories at github.com/asharahmed.

Recourse Digital Services Inc. is a separate organization; report issues in its products through getrecourse.ca.

How to report

Email ashar [at] aahmed.ca. Encrypt the message with my PGP key (fingerprint FE07 2B0C 1183 94CF 9FC5 0DF5 1CBF 0085 8C3E 8CFD) if it contains anything sensitive.

Please include what you found, where, the steps to reproduce it, and what an attacker could do with it. A proof of concept helps; a working exploit against other people does not.

What to expect

• An acknowledgement within five business days.
• Updates as I investigate and fix the issue.
• Credit in the fix or release notes if you want it, under the name you choose.

This is a personal site, so there is no bug bounty.

Safe harbour

If you make a good-faith effort to follow this policy, I consider your research authorized, I will not pursue legal action against you, and I will not ask anyone else to. In return:

• Do not degrade the service: no denial of service, load testing or automated scanning at volume.
• Do not use social engineering, phishing or physical attacks.
• Access only what you need to show the problem. If you reach someone else's data, stop, do not keep a copy, and tell me.
• Give me a reasonable time to fix the issue before you publish it. Ninety days is the default; I will tell you if I need longer and why.

Not vulnerabilities

• The easter eggs. If something on this site looks like a leaked flag, a hidden page or an odd header, it is there on purpose. Submit flags in the terminal, not by email.
• The visitor counter can be inflated. It is a hit counter in the 1998 tradition and was never accurate.
• Reports from automated scanners about missing headers or best practices, without a demonstrated impact.
• Clickjacking on pages with no actions to hijack, and self-XSS.