Responsible disclosure
Security Policy
Responsible disclosure guidelines for reporting security vulnerabilities.
Report a Vulnerability
Found a security issue? Contact me directly at [email protected]
Scope
This security policy applies to the following assets:
raoufabedini.dev— This portfolio website- Any open-source repositories under
github.com/Raoof128
What to Report
In Scope
- Cross-Site Scripting (XSS)
- Cross-Site Request Forgery (CSRF)
- Security misconfigurations
- Information disclosure
- Authentication/authorisation flaws
- Injection vulnerabilities
Out of Scope
- Social engineering attacks
- Physical security issues
- Denial of Service (DoS/DDoS)
- Spam or phishing attempts
- Issues in third-party services
- Rate limiting issues
Response Timeline
Initial Response: 48-72 hours
I will acknowledge receipt of your report and provide an initial assessment.
Resolution: 7-30 days
Depending on severity, I will work to resolve the issue within this timeframe.
Disclosure: Coordinated
We will coordinate public disclosure after the fix is deployed.
Responsible Disclosure Guidelines
- Do not access, modify, or delete data that does not belong to you.
- Do not perform attacks that could harm the availability of services.
- Provide sufficient information to reproduce the vulnerability.
- Give reasonable time to address the issue before public disclosure.
- Act in good faith and avoid privacy violations.
Acknowledgements
I appreciate responsible security researchers who help improve the security of my projects. Valid reports may be acknowledged in the Security Hall of Fame.
Note: This is a personal portfolio project. No monetary bounties are offered, but valid reports may be recognised here.